UBUNTU-CVE-2018-16886

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2018-16886
Published: 14 Jan 2019, 19:29
Last modified:08 Sept 2025, 16:45

Vulnerability Summary

Overall Risk (default)
medium
32/100
CVSS Score
8.1 HIGH
3.1 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Jan 2019, 19:29
Published
Vulnerability first disclosed
08 Sept 2025, 16:45
Last Modified
Vulnerability information updated

Description

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

CVSS Metrics

  • v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.0•MEDIUM•Score: 6.8CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Systems

  • ubuntu•etcd

    all

References (9)