CVE-2025-66406: Step CA SSH Certificate Revocation Bypass

CVE-2025-66406 is an authorization bypass flaw in Step CA that affects SSH certificate revocation for deployments using the SSHPOP provisioner. This vulnerability allows improper access control during revocation processes. This article covers the technical details, affected versions below 0.29.0, security impact, and available patches.

CVE-2025-66406 Overview

CVE-2025-66406 is an improper authorization vulnerability [CWE-863] in Step CA, an online certificate authority used for automated certificate management in DevOps environments. The flaw resides in the SSH certificate revocation workflow and affects deployments configured with the SSHPOP provisioner. An authenticated actor can abuse the authorization check to revoke SSH certificates outside the intended scope. The vulnerability affects all versions prior to 0.29.0 and is addressed in release 0.29.0.

Critical Impact
Attackers with high-privilege access to a Step CA deployment using the SSHPOP provisioner can revoke SSH certificates they should not be authorized to revoke, disrupting SSH-based access across managed infrastructure.

Affected Products

Step CA (smallstep/certificates) versions prior to 0.29.0
Deployments configured with the SSHPOP provisioner
Downstream integrations relying on SSHPOP-based SSH certificate lifecycle management

Discovery Timeline

2025-12-03 - CVE-2025-66406 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66406

Vulnerability Analysis

Step CA issues and manages short-lived SSH certificates through configurable provisioners. The SSHPOP (SSH Proof-of-Possession) provisioner allows a holder of an existing SSH certificate to prove possession of its private key and then request lifecycle operations such as renewal or revocation. The vulnerability stems from an incomplete authorization check during the SSH certificate revocation path. The server validates that the caller holds a valid SSH certificate but does not sufficiently verify that the certificate being revoked belongs to the caller.

An attacker with a valid SSHPOP-authenticated session can issue a revocation request targeting another principal's SSH certificate. Successful revocation invalidates the targeted certificate, denying its holder further access to systems that trust the Step CA SSH host or user certificates. The impact is scoped to integrity of certificate state and availability of SSH access, with no direct disclosure of secret material.

Root Cause

The root cause is a missing ownership check in the SSHPOP revocation handler. The code path confirms authentication through proof-of-possession but does not bind the revocation target to the authenticated certificate's identity, violating the authorization model expected by SSH certificate lifecycle operations.

Attack Vector

Exploitation requires network reachability to the Step CA endpoint and valid SSHPOP credentials, meaning the attacker must already possess a legitimate SSH certificate issued by the same CA. The attack is executed by crafting an SSH certificate revocation request that references a serial number or identifier belonging to a different principal.

// No verified public exploit code is available for CVE-2025-66406.
// Refer to the vendor advisory for technical details:
// https://github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hpr

Detection Methods for CVE-2025-66406

Indicators of Compromise

Unexpected SSH certificate revocation entries in the Step CA audit log, especially those initiated via the SSHPOP provisioner.
Revocation requests where the authenticated principal does not match the subject of the revoked certificate.
Clusters of SSH authentication failures following revocation events on hosts that previously trusted the certificate.

Detection Strategies

Review Step CA access logs for POST /ssh/revoke or equivalent revocation endpoint calls tied to SSHPOP tokens.
Correlate certificate serial numbers in revocation events with the authenticated caller identity to flag mismatches.
Alert on spikes in SSH certificate revocations outside of normal rotation windows or automated workflows.

Monitoring Recommendations

Forward Step CA audit logs to a centralized log platform and retain them for forensic review.
Monitor SSH host and user certificate validity across managed fleets to detect premature invalidation.
Track SSHPOP provisioner usage metrics and investigate unexpected volume changes.

How to Mitigate CVE-2025-66406

Immediate Actions Required

Upgrade Step CA to version 0.29.0 or later on all CA nodes.
Audit SSHPOP provisioner configurations and limit which principals can authenticate through them.
Review recent SSH certificate revocation events for unauthorized actions and reissue certificates where needed.

Patch Information

The maintainers of smallstep/certificates fixed the improper authorization check in release 0.29.0. Operators should upgrade from any version prior to 0.29.0. See the GitHub Security Advisory GHSA-j7c9-79x7-8hpr for full remediation details.

Workarounds

Disable the SSHPOP provisioner in ca.json until the upgrade to 0.29.0 can be completed.
Restrict network access to the Step CA revocation endpoints to trusted automation hosts only.
Issue shorter-lived SSH certificates to reduce the window of impact if an unauthorized revocation occurs.

bash

# Example: remove or disable the SSHPOP provisioner entry in ca.json
# then restart step-ca to apply the configuration change
sudo systemctl restart step-ca