CVE-2020-15136
Improper authentication in etcd
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper authentication in etcd
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
- Record
CVE-2020-15136- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2024-0452
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
- Record
EUVD-2024-0452- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wr2v-9rpq-c35q
Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records
Vulnerability type
Cryptography
Workarounds
Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.
Detail
When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.
References
Find out more on this vulnerability in the security audit report
For more information
If you have any questions or comments about this advisory:
- Contact the etcd security committee
- Record
GHSA-wr2v-9rpq-c35q- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-287, CWE-306
- Updated
- 2026-11-02
NVD
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
- Record
CVE-2020-15136- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-287, CWE-306
- Updated
- 2026-11-02
OSVAZL-6393
CVE-2020-15136 affecting package etcd for versions less than 3.5.0-3
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
- Record
AZL-6393- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSV
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
- Record
CVE-2020-15136- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2020-15136
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
- Record
DEBIAN-CVE-2020-15136- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-wr2v-9rpq-c35q
Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records
Vulnerability type
Cryptography
Workarounds
Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.
Detail
When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.
References
Find out more on this vulnerability in the security audit report
For more information
If you have any questions or comments about this advisory:
- Contact the etcd security committee
- Record
GHSA-wr2v-9rpq-c35q- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-287, CWE-306
- Updated
- 2026-11-02
OSVRHSA-2021:0916
Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.4 (etcd) security update
- Record
RHSA-2021:0916- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-15136
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
- Record
UBUNTU-CVE-2020-15136- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
go.etcd.io/etcdGo |
3.4.0-rc.0 to 3.4.9 | 3.4.10 |
go.etcd.io/etcdGo |
before 3.3.23 | 3.3.23 |
etcdAzure Linux:2 |
before 3.5.0-3 | 3.5.0-3 |
etcdDebian:12 |
before 3.3.25+dfsg-5 | 3.3.25+dfsg-5 |
etcdDebian:13 |
before 3.3.25+dfsg-5 | 3.3.25+dfsg-5 |
etcdDebian:14 |
before 3.3.25+dfsg-5 | 3.3.25+dfsg-5 |
go.etcd.io/etcdGo |
3.4.0-rc.0 up to 3.4.10 | 3.4.10 |
etcdRed Hat:openstack:16.1::el8 From an advisory covering 6 CVEs |
before 0:3.3.23-1.el8ost | 0:3.3.23-1.el8ost |
etcd-debuginfoRed Hat:openstack:16.1::el8 From an advisory covering 6 CVEs |
before 0:3.3.23-1.el8ost | 0:3.3.23-1.el8ost |
etcd-debugsourceRed Hat:openstack:16.1::el8 From an advisory covering 6 CVEs |
before 0:3.3.23-1.el8ost | 0:3.3.23-1.el8ost |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
etcdUbuntu:16.04:LTS |
All versions, plus listed versions 2.2.0+dfsg-22.2.1+dfsg-12.2.2+dfsg-12.2.2+dfsg-22.2.3+dfsg-12.2.5+dfsg-12.2.5+dfsg-1ubuntu1 |
None known |
etcdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.1.0-13.2.9+dfsg-23.2.9+dfsg-33.2.17+dfsg-13.2.17+dfsg-1ubuntu0.1~esm13.2.17+dfsg-1ubuntu0.13.2.17+dfsg-1ubuntu0.1+esm13.2.17+dfsg-1ubuntu0.1+esm2 |
None known |
etcdUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.2.26+dfsg-33.2.26+dfsg-43.2.26+dfsg-63.2.26+dfsg-6ubuntu0.13.2.26+dfsg-6ubuntu0.23.2.26+dfsg-6ubuntu0.2+esm1 |
None known |
etcdUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.3.25+dfsg-63.3.25+dfsg-73.3.25+dfsg-7ubuntu0.22.04.13.3.25+dfsg-7ubuntu0.22.04.1+esm13.3.25+dfsg-7ubuntu0.22.04.23.3.25+dfsg-7ubuntu0.22.04.2+esm13.3.25+dfsg-7ubuntu0.22.04.2+esm23.3.25+dfsg-7ubuntu0.22.04.2+esm3 |
None known |
etcdUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.4.23-4ubuntu23.4.30-13.4.30-1build13.4.30-1ubuntu0.24.04.13.4.30-1ubuntu0.24.04.2 Show 4 moreShow less3.4.30-1ubuntu0.24.04.2+esm13.4.30-1ubuntu0.24.04.33.4.30-1ubuntu0.24.04.3+esm13.4.30-1ubuntu0.24.04.3+esm2 |
None known |
etcdUbuntu:25.10 |
All versions, plus listed versions 3.5.16-4 |
None known |
etcdUbuntu:26.10 |
All versions, plus listed versions 3.5.16-103.5.30-2 |
None known |
etcdUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 3.5.16-43.5.16-103.5.16-10ubuntu0.26.04.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15136 is a medium vulnerability (CVSS 6.5) in Etcd-io Etcd, published August 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in go.etcd.io/etcd 3.4.10.
References
github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP
nvd.nist.gov/vuln/detail/CVE-2020-15136
Show 33 moreShow less
security-tracker.debian.org/tracker/CVE-2020-15136
access.redhat.com/errata/RHSA-2021:0916
bugzilla.redhat.com/show_bug.cgi?id=1868870
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0916.json
cve.org/CVERecord?id=CVE-2020-15106
ubuntu.com/security/CVE-2020-15136