Read the docs

etcd-io

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

etcd-io records in CISA KEV

No etcd-io vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Etcd 11 records MEDIUM

Records

16 records

TI-2026-25810 CVE-2026-33413 · GHSA-q8m4-xhhv-38mg

etcd: Authorization bypasses in multiple APIs

Priority MEDIUM 44

etcd is a distributed key-value store for the data of a distributed system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00258 Published 2026-03-26 Partial fix · 3.6.9, 3.5.28 +1 CWE-862
TI-2018-12096 CVE-2018-16886 · GHSA-h6xx-pmxh-3wgp

Improper authentication in etcd:

Priority MEDIUM 42

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.04064 Published 2019-01-14 Partial fix · 3.2.26, 3.3.11 +1 CWE-287
TI-2020-11890 CVE-2020-15115 · GHSA-4993-m7g5-r9hh

No minimum password length in etcd

Priority LOW 36

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01342 Published 2020-08-06 Partial fix · 3.3.23, 3.4.10 CWE-521
TI-2020-11889 CVE-2020-15114 · GHSA-2xhq-gv6c-p224

Denial of Service in etcd

Priority LOW 36

In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01127 Published 2020-08-06 Partial fix · 3.3.23, 3.4.10 CWE-400
TI-2020-11909 CVE-2020-15136 · GHSA-wr2v-9rpq-c35q

Improper authentication in etcd

Priority LOW 32

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0165 Published 2020-08-06 Partial fix · 3.4.10, 3.3.23 CWE-287
TI-2020-11888 CVE-2020-15113 · GHSA-chh6-ppwq-jh92

Improper Preservation of Permissions in etcd

Priority LOW 31

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00218 Published 2020-08-05 Partial fix · 3.3.23, 3.4.10 CWE-281
TI-2020-11887 CVE-2020-15112 · GHSA-m332-53r6-2w93

Improper Input Validation in etcd

Priority LOW 31

In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01256 Published 2020-08-05 Partial fix · 3.3.23, 3.4.10 CWE-20
TI-2020-11881 CVE-2020-15106 · GHSA-p4g4-wgrh-qrg2

Improper Input Validation in etcd

Priority LOW 31

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01256 Published 2020-08-05 Partial fix · 3.3.23, 3.4.10 +1 CWE-20
TI-2023-15386 CVE-2023-32082 · GHSA-3p4g-rcw5-8298

etcd key name can be accessed via LeaseTimeToLive API

Priority LOW 21

etcd is a distributed key-value store for the data of a distributed system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00744 Published 2023-05-11 Partial fix · 3.4.26, 3.5.9 CWE-200
Open these records in search →