TI-2020-11909 Aliases CVE-2020-15136 GHSA-wr2v-9rpq-c35q

Improper authentication in etcd

LOW 32CWE-287Published 2020-08-06 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · None
Fix status: Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

Why it matters now

EPSS 0.0165 76th percentileScored 2026-11-07

Fix Partial etcd (etcd-io): 3.4.10, 3.3.23go.etcd.io/etcd (Go): 3.4.10, 3.3.23Red Hat: 2 advisoriesRed Hat: 2 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
etcd-io	etcd	3.4.0 to before 3.4.10; before 3.3.23	3.4.10, 3.3.23	Patch available	CNA
—	go.etcd.io/etcd (Go)	3.4.0-rc.0 to before 3.4.10	3.4.10	Patch available	GHSA-wr2v-9rpq-c35q
—	go.etcd.io/etcd (Go)	before 3.3.23	3.3.23	Patch available	GHSA-wr2v-9rpq-c35q

etcd Vendoretcd-io Affected 3.4.0 to before 3.4.10; before 3.3.23 Fixed in 3.4.10, 3.3.23 Patch available CNA
go.etcd.io/etcd (Go) Vendor— Affected 3.4.0-rc.0 to before 3.4.10 Fixed in 3.4.10 Patch available GHSA-wr2v-9rpq-c35q
go.etcd.io/etcd (Go) Vendor— Affected before 3.3.23 Fixed in 3.3.23 Patch available GHSA-wr2v-9rpq-c35q

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:redhat:etcd::::::::	3.3.0 to before 3.3.23; 3.4.0 to before 3.4.10	Vulnerable	Red Hat
cpe:2.3:o:fedoraproject:fedora:32:::::::*	32	Vulnerable	Fedoraproject

cpe:2.3:a:redhat:etcd:*:*:*:*:*:*:*:* Versions 3.3.0 to before 3.3.23; 3.4.0 to before 3.4.10 Vulnerable ·Red Hat
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject

Remediation

Fix · CNA etcd (etcd-io) Fixed in 3.4.10, 3.3.23
Fix · GHSA-wr2v-9rpq-c35q go.etcd.io/etcd (Go) Fixed in 3.4.10 Advisory →
Fix · GHSA-wr2v-9rpq-c35q go.etcd.io/etcd (Go) Fixed in 3.3.23 Advisory →

Red Hat 2 advisories

RHSA-2021:2438 Released 2021-07-27 · Red Hat rating Moderate
OpenShift Container Platform 4.8.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
RHSA-2021:0916 Released 2021-03-17 · Red Hat rating Moderate
Red Hat OpenStack Platform 16.1.4 (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-1.el8ost

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2020-08-05
etcd-io etcd — FEDORA-2020-cd43b84c16
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2020-11890 No minimum password length in etcdPriority LOW 36
- TI-2020-11889 Denial of Service in etcdPriority LOW 36
- TI-2020-11888 Improper Preservation of Permissions in etcdPriority LOW 31
Show all 6 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 15 (Stein)	Affected	No fix yet: Fix deferred
Red Hat Storage 3	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 4.8	Fixed	RHSA-2021:2438
Red Hat OpenStack Platform 16.1	Fixed	RHSA-2021:0916

Not affected: 2 products

Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat OpenShift Container Platform 4.8

Timeline

2026-10-02 Threatist record created from CVE-2020-15136
2026-10-03 Alias added: GHSA-wr2v-9rpq-c35q

References

Advisory 3

Other 2

TI-2021-09444 Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to… CVSS 3.1CRITICAL 9.8
TI-2026-51612 etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline CVSS 4.0HIGH 8.7
TI-2026-25810 etcd: Authorization bypasses in multiple APIs CVSS 4.0HIGH 8.8
TI-2022-15016 Etcd v3.5.4 allows remote attackers to cause a denial of service via function… CVSS 3.1HIGH 7.5
TI-2018-12096 Improper authentication in etcd: CVSS 3.1HIGH 8.1
TI-2026-42635 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation CVSS 3.1HIGH 8.1

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences