Etcd
Monthly
Memory exhaustion in etcd's TLS acceptor loop allows unauthenticated network attackers to crash etcd clusters - and the Kubernetes control planes they back - without completing a TLS handshake. The vulnerable code path in `client/pkg/transport/listener_tls.go` spawns a goroutine per inbound TCP connection with no timeout, meaning connections that never send a ClientHello block indefinitely inside `tls.Conn.Handshake()` and accumulate in an unbounded `pending` map. Exploitation is trivially automatable: no special protocol knowledge is needed beyond initiating TCP connections. No public exploit code or CISA KEV listing exists at time of analysis, but the Kubernetes control plane dependency elevates real-world blast radius well beyond a standalone etcd outage.
Watch API authorization bypass in etcd allows any authenticated low-privilege user to silently read the entire keyspace beyond their granted key. A user holding a READ grant on a single exact key can invoke the Watch gRPC API with clientv3.WithFromKey() to receive streaming events for every key lexicographically greater than or equal to their permitted key - an unbounded confidentiality breach against etcd's RBAC model. Affected versions span etcd prior to 3.5.33, 3.6.0-3.6.13, and 3.7.0 pre-releases; fixes are released as 3.5.33, 3.6.14, and 3.7.1. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial exploit path (a single standard gRPC flag) makes weaponization straightforward for any attacker with valid credentials.
Certificate revocation bypass in etcd affects clusters running versions before 3.5.32 and before 3.6.13 that are configured with --listen-client-http-urls to serve HTTP and gRPC client traffic on separate listeners. In that split-listener mode the --client-crl-file Certificate Revocation List is silently ignored on the gRPC listener, so a client presenting a certificate the operator has explicitly revoked can still complete mutual-TLS authentication and gain full read/write access to the key-value store. There is no public exploit identified at time of analysis and EPSS is low (0.36%), but the technical impact is total for anyone relying on CRL-based deauthorization.
etcd is a distributed key-value store for the data of a distributed system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Memory exhaustion in etcd's TLS acceptor loop allows unauthenticated network attackers to crash etcd clusters - and the Kubernetes control planes they back - without completing a TLS handshake. The vulnerable code path in `client/pkg/transport/listener_tls.go` spawns a goroutine per inbound TCP connection with no timeout, meaning connections that never send a ClientHello block indefinitely inside `tls.Conn.Handshake()` and accumulate in an unbounded `pending` map. Exploitation is trivially automatable: no special protocol knowledge is needed beyond initiating TCP connections. No public exploit code or CISA KEV listing exists at time of analysis, but the Kubernetes control plane dependency elevates real-world blast radius well beyond a standalone etcd outage.
Watch API authorization bypass in etcd allows any authenticated low-privilege user to silently read the entire keyspace beyond their granted key. A user holding a READ grant on a single exact key can invoke the Watch gRPC API with clientv3.WithFromKey() to receive streaming events for every key lexicographically greater than or equal to their permitted key - an unbounded confidentiality breach against etcd's RBAC model. Affected versions span etcd prior to 3.5.33, 3.6.0-3.6.13, and 3.7.0 pre-releases; fixes are released as 3.5.33, 3.6.14, and 3.7.1. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial exploit path (a single standard gRPC flag) makes weaponization straightforward for any attacker with valid credentials.
Certificate revocation bypass in etcd affects clusters running versions before 3.5.32 and before 3.6.13 that are configured with --listen-client-http-urls to serve HTTP and gRPC client traffic on separate listeners. In that split-listener mode the --client-crl-file Certificate Revocation List is silently ignored on the gRPC listener, so a client presenting a certificate the operator has explicitly revoked can still complete mutual-TLS authentication and gain full read/write access to the key-value store. There is no public exploit identified at time of analysis and EPSS is low (0.36%), but the technical impact is total for anyone relying on CRL-based deauthorization.
etcd is a distributed key-value store for the data of a distributed system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.