CVE-2026-40097

OVERVIEW CVE-2026-40097 is a denial-of-service vulnerability affecting Step CA versions 0.24.0 through 0.30.0-rc2, an online certificate authority platform used for automated certificate management in DevOps environments. The flaw exists in the TPM device attestation validation logic, where an attacker can craft a malicious attestation key certificate with an empty Extended Key Usage extension to trigger an index out-of-bounds panic. Only deployments utilizing TPM device attestation for ACME challenges are vulnerable; standard certificate issuance workflows are unaffected. SEVERITY The vulnerability carries a CVSS 3.1 score of 3.7 (LOW) with a network-based attack vector requiring high attack complexity and no user interaction. An unauthenticated attacker can remotely trigger the denial-of-service condition by sending a specially crafted certificate during the TPM attestation process. The impact is limited to service availability; there is no risk to confidentiality or integrity. The EPSS score of 0.0004 indicates minimal real-world exploitation likelihood. EXPLOITATION STATUS There is no evidence of active exploitation, with the vulnerability absent from the Known Exploited Vulnerabilities catalog and showing no community attention on threat intelligence platforms. The flaw was addressed in Step CA version 0.30.0-rc3, and organizations running affected versions should prioritize patching to mitigate the denial-of-service risk.