CVE-2018-16886: etcd Improper Authentication
Vulnerability summary
CVE-2018-16886 is a high (CVSS 8.1) Improper Authentication vulnerability in etcd. EPSS estimates a 4.03% chance of exploitation in the next 30 days, higher than 90.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 5Timeline
- 14-01-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
CVSS metrics
10 scores · 7 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST6.8MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · Red hatEcosystem advisory · calculated6.8MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
4.03%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 4.03% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat5 products
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_workstation7.0
- etcd< 0:3.2.26-1.el7
- etcd-debuginfo< 0:3.2.26-1.el7
Chainguard3 products
- etcd-3.4< 3.4.36-r1
- etcd-3.4-iamguarded-compat< 3.4.36-r1
- etcd-fips-3.4< 3.4.36-r1
Debian1 product
- etcd< 3.2.26+dfsg-1
Etcd1 product
- etcd≥ 3.2.0, < 3.2.26 | ≥ 3.3.0, < 3.3.11
Fedoraproject1 product
- fedoraEOL30
Go.etcd.io1 product
- etcd< 0.5.0-alpha.5.0.20190108173120-83c051b701d3
Go.etcd.io/etcd1 product
- v3≥ 3.2.0, < 3.2.26 | ≥ 3.3.0, < 3.3.11
The etcd project1 product
- etcd:versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11
Ubuntu1 product
- etcdAll versions (No fix recorded)
9 vendors · 15 products
References
28 links- github.com/etcd-io/etcd/blob/1eee465a43720d713bb69f7b7f5e120135fdb1ac/CHANGELOG-3.3.mdX Refsource MISCRelease NotesWEBAdvisory
- github.com/etcd-io/etcd/blob/1eee465a43720d713bb69f7b7f5e120135fdb1ac/CHANGELOG-3.2.mdX Refsource MISCRelease NotesWEBAdvisory
- access.redhat.com/errata/RHSA-2019:0237Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16886X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORTWEBFIX
- access.redhat.com/errata/RHSA-2019:1352Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
Show all 28 references
- github.com/etcd-io/etcdPACKAGE