vulnerability in perforator project

[ankitdn]

While working on perforator project, I identified a vulnerability (CVE-2025-66406) in Step CA’s SSHPOP provisioner. Due to an improper authorization check, an attacker with limited access could revoke SSH certificates without proper permissions, potentially disrupting secure access across systems using these certificates.

CVE Link
CVE Report

[MikailBag]

Could you please clarify, how is that vulnerability related to perforator?
AFAIR we neither depend on Step CA, nor recommend it in our documentation.

[MikailBag]

(Closing until we can see relation to Perforator)