Skip to content
Fencer Vulns
medium 6.8

CVE-2018-16886 json

go.etcd.io/etcd Authentication Bypass

published 2019-01-14 7 y ago modified 2026-09-10 1 mo ago also GHSA-h6xx-pmxh-3wgp , GO-2021-0077 , EUVD-2022-1756

cvss
6.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.1%
EPSS 4.1% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Patch / fix

  • go go.etcd.io/etcd/v3 3.2.26, 3.3.11
  • go go.etcd.io/etcd 0.5.0-alpha.5.0.20190108173120-83c051b701d3
  • etcd etcd 3.2.26, 3.3.11
  • etcd Debian 14, Debian 13, Debian 12 3.2.26+dfsg-1

debian advisories DEBIAN-CVE-2018-16886

  • etcd RHEL 7 EXTRAS_OTHER 3.2.26-1.el7

red hat advisories RHSA-2019:1352

  • etcd openSUSE Leap 15.6, openSUSE Leap 15.5 3.5.12-150000.7.6.1

suse advisories SUSE-SU-2024:3656-1

  • etcd openSUSE Tumbleweed 3.4.16-3.1

opensuse advisories openSUSE-SU-2024:10741-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-16886 updated cvss 6.8

etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway

  • Red Hat Storage 3 etcd
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 Extras etcd 3.2.26-1.el7
    fixed: vendor fix RHSA-2019:1352
  • Red Hat Enterprise Linux 7 etcd3 Red Hat OpenShift Container Platform 3.11 metrics-server, atomic-openshift, cluster-autoscaler, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, +9 more Red Hat OpenShift Container Platform 4 openshift4/ose-etcd
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.06% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 6.8 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go go.etcd.io/etcd/v3
>=3.2.0, <3.2.26
>=3.3.0, <3.3.11
3.2.26
3.3.11
go go.etcd.io/etcd
<0.5.0-alpha.5.0.20190108173120-83c051b701d3
0.5.0-alpha.5.0.20190108173120-83c051b701d3

Affected products

  • The etcd Project etcd:

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.