CVE-2026-40097: Step CA TPM Attestation DoS Vulnerability

CVE-2026-40097 Overview

CVE-2026-40097 is an Out-of-Bounds Read vulnerability affecting Step CA, an online certificate authority designed for secure, automated certificate management in DevOps environments. The vulnerability exists in versions from 0.24.0 to before 0.30.0-rc3 and can be exploited by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage (EKU) extension during TPM device attestation.

When Step CA processes a device-attest-01 ACME challenge using TPM attestation, it validates that the AK certificate contains the tcg-kp-AIKCertificate Extended Key Usage OID. During this validation, the EKU extension value is decoded from its ASN.1 representation and the first element is checked. A specially crafted certificate can include an EKU extension that decodes to an empty sequence, causing the code to panic when attempting to access the first element of an empty slice.

Critical Impact

An attacker can trigger a denial of service condition by causing the Step CA server to panic via a crafted AK certificate with an empty EKU extension during TPM attestation.

Affected Products

• Step CA versions 0.24.0 to 0.30.0-rc2
• Deployments using device-attest-01 ACME challenge with TPM attestation

Discovery Timeline

• April 10, 2026 - CVE-2026-40097 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40097

Vulnerability Analysis

This vulnerability is classified under CWE-129 (Improper Validation of Array Index). The flaw resides in Step CA's TPM attestation handling logic, specifically in how the application processes Extended Key Usage extensions within attestation key certificates.

When Step CA validates an AK certificate during a device-attest-01 ACME challenge, it attempts to verify the presence of the tcg-kp-AIKCertificate OID in the certificate's EKU extension. The validation routine decodes the ASN.1-encoded EKU extension and directly accesses the first element of the resulting slice without first checking if the slice contains any elements.

This missing bounds check creates a condition where an attacker can craft a certificate with a valid but empty EKU extension structure. When processed, this causes an index out-of-bounds panic in Go, immediately crashing the Step CA process and resulting in a denial of service.

Root Cause

The root cause is improper validation of array bounds before accessing slice elements. The code assumes the EKU extension will always contain at least one OID after ASN.1 decoding, but this assumption fails when an attacker provides a certificate with a syntactically valid but semantically empty EKU extension. The lack of a defensive check for an empty slice before array access leads to the panic condition.

Attack Vector

The attack requires network access to the Step CA server with TPM device attestation configured. An attacker can exploit this vulnerability by:

1. Initiating a device-attest-01 ACME challenge request
2. Providing a crafted AK certificate during the TPM attestation flow
3. Including an EKU extension that decodes to an empty sequence
4. Triggering the panic when Step CA attempts to validate the first EKU element

The vulnerability is only reachable in deployments that have configured TPM device attestation for ACME challenges. Deployments not using this feature are not affected.

The vulnerability mechanism involves the ASN.1 decoding of the Extended Key Usage extension. When Step CA parses the AK certificate, it extracts the EKU extension bytes and unmarshals them into a slice of OIDs. The code then directly accesses index 0 of this slice to check for the tcg-kp-AIKCertificate OID. With a crafted certificate containing an empty EKU sequence, this access triggers a Go runtime panic. See the GitHub Security Advisory for technical implementation details.

Detection Methods for CVE-2026-40097

Indicators of Compromise

• Step CA service crashes or unexpected restarts during TPM attestation operations
• Log entries indicating panic conditions related to index out-of-bounds errors
• Abnormal ACME challenge requests with malformed or unusual AK certificates
• Evidence of repeated device-attest-01 challenge attempts from suspicious sources

Detection Strategies

• Monitor Step CA logs for panic stack traces containing references to EKU validation or slice index errors
• Implement alerting on Step CA process crashes or restarts
• Analyze incoming ACME challenge requests for certificates with empty or malformed EKU extensions
• Deploy network monitoring to detect anomalous patterns in TPM attestation traffic

Monitoring Recommendations

• Enable verbose logging for Step CA's ACME challenge processing
• Configure process monitoring to detect and alert on Step CA crashes
• Implement log aggregation to correlate crash events with incoming certificate requests
• Monitor system resources for signs of repeated denial of service attempts

How to Mitigate CVE-2026-40097

Immediate Actions Required

• Upgrade Step CA to version 0.30.0-rc3 or later immediately
• Review Step CA logs for evidence of exploitation attempts
• Implement network-level restrictions on access to ACME endpoints if TPM attestation is not required
• Consider temporarily disabling TPM device attestation if the upgrade cannot be performed immediately

Patch Information

The vulnerability has been fixed in Step CA version 0.30.0-rc3 and the stable 0.30.0 release. The fix adds proper bounds checking before accessing the EKU slice elements.

Workarounds

• Disable TPM device attestation if it is not actively required for your deployment
• Implement network segmentation to restrict access to the ACME endpoint from untrusted networks
• Deploy a reverse proxy or WAF to filter potentially malicious ACME challenge requests
• Monitor and rate-limit device-attest-01 challenge requests to reduce impact of exploitation attempts

# Upgrade Step CA to the fixed version
# Using Go to install the latest version
go install github.com/smallstep/certificates/cmd/step-ca@v0.30.0

# Alternatively, download the release binary
wget https://github.com/smallstep/certificates/releases/download/v0.30.0/step-ca_linux_amd64.tar.gz
tar -xzf step-ca_linux_amd64.tar.gz
sudo mv step-ca /usr/local/bin/

# Restart the Step CA service after upgrade
sudo systemctl restart step-ca