CVE-2026-40097: Step CA affected by an index out of bounds panic in TPM attestation EKU validation

An attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage (EKU) extension during TPM device attestation.

References

Code Behaviors & Features

Detect and mitigate CVE-2026-40097 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →