CVE-2020-15136: etcd-io etcd Improper Authentication
Vulnerability summary
CVE-2020-15136 is a medium (CVSS 6.5) Improper Authentication vulnerability in etcd-io etcd. EPSS estimates a 1.64% chance of exploitation in the next 30 days, higher than 75.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 4Timeline
- 06-08-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
CVSS metrics
8 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS trend
Probability
1.64%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
0.00 pp
From 1.64% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Chainguard4 products
- dgraph< 23.1.0-r6
- etcd-3.4< 3.4.36-r1
- etcd-3.4-iamguarded-compat< 3.4.36-r1
- etcd-fips-3.4< 3.4.36-r1
Debian1 product
- etcd< 3.3.25+dfsg-5
Etcd-io1 product
- etcd≥ 3.4.0, < 3.4.10 | < 3.3.23
Fedoraproject1 product
- fedoraEOL32
Go.etcd.io1 product
- etcd≥ 3.4.0-rc.0, < 3.4.10 | < 3.3.23
Redhat1 product
- etcd≥ 3.3.0, < 3.3.23 | ≥ 3.4.0, < 3.4.10
Ubuntu1 product
- etcdAll versions (No fix recorded)
Wolfi1 product
- dgraph< 23.1.0-r6
8 vendors · 11 products
References
8 links- github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35qX Refsource CONFIRMREPORTAdvisoryWEBThird Party Advisory
- github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.mdX Refsource MISCREPORTWEBBroken Link
