CVE-2018-1098

etcd Cross-site Request Forgery (CSRF)

8.8 HighFix available

CVE-2018-1098 is a high vulnerability (CVSS 8.8) in Etcd-io Etcd, published April 3, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in go.etcd.io/etcd/v3 3.4.0.

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.22%Up 0.1 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2018-1098
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-1098
Weakness: CWE-352
Updated: 2026-11-02

EUVDEUVD-2022-0838 No score

Record: EUVD-2022-0838
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5gjm-fj42-x983 8.8

etcd Cross-site Request Forgery (CSRF)

Record: GHSA-5gjm-fj42-x983
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

OSV 8.8

Record: CVE-2018-1098
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-1098 8.8

Record: DEBIAN-CVE-2018-1098
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-5gjm-fj42-x983 8.8

etcd Cross-site Request Forgery (CSRF)

Record: GHSA-5gjm-fj42-x983
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-1098 8.8

Record: UBUNTU-CVE-2018-1098
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`go.etcd.io/etcd/v3` Go	before 3.4.0	3.4.0
`etcd` Debian:12	before 3.4.23-1	3.4.23-1
`etcd` Debian:13	before 3.4.23-1	3.4.23-1
`etcd` Debian:14	before 3.4.23-1	3.4.23-1
`etcd` Ubuntu:16.04:LTS	All versions, plus listed versions 2.2.0+dfsg-22.2.1+dfsg-12.2.2+dfsg-12.2.2+dfsg-22.2.3+dfsg-12.2.5+dfsg-12.2.5+dfsg-1ubuntu1	None known
`etcd` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.1.0-13.2.9+dfsg-23.2.9+dfsg-33.2.17+dfsg-13.2.17+dfsg-1ubuntu0.1~esm13.2.17+dfsg-1ubuntu0.13.2.17+dfsg-1ubuntu0.1+esm13.2.17+dfsg-1ubuntu0.1+esm2	None known
`etcd` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 3.2.26+dfsg-33.2.26+dfsg-43.2.26+dfsg-63.2.26+dfsg-6ubuntu0.13.2.26+dfsg-6ubuntu0.23.2.26+dfsg-6ubuntu0.2+esm1	None known
`etcd` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 3.3.25+dfsg-63.3.25+dfsg-73.3.25+dfsg-7ubuntu0.22.04.13.3.25+dfsg-7ubuntu0.22.04.1+esm13.3.25+dfsg-7ubuntu0.22.04.23.3.25+dfsg-7ubuntu0.22.04.2+esm13.3.25+dfsg-7ubuntu0.22.04.2+esm23.3.25+dfsg-7ubuntu0.22.04.2+esm3	None known
`etcd` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 3.4.23-4ubuntu23.4.30-13.4.30-1build13.4.30-1ubuntu0.24.04.13.4.30-1ubuntu0.24.04.2 Show 4 moreShow less 3.4.30-1ubuntu0.24.04.2+esm13.4.30-1ubuntu0.24.04.33.4.30-1ubuntu0.24.04.3+esm13.4.30-1ubuntu0.24.04.3+esm2	None known
`etcd` Ubuntu:25.10	All versions, plus listed versions 3.5.16-4	None known
`etcd` Ubuntu:26.10	All versions, plus listed versions 3.5.16-103.5.30-2	None known
`etcd` Ubuntu:Pro:26.04:LTS	All versions, plus listed versions 3.5.16-43.5.16-103.5.16-10ubuntu0.26.04.1~esm1	None known

History

History
When	Changed	Sources
2026-11-03	aliases, products	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 7 moreShow less