Every CVE Search/ Get API key

CVE-2023-32082

etcd key name can be accessed via LeaseTimeToLive API

3.1 LowFix available

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.74%Up 0.7 points since May 12, 2023
90%50%10%1%

What each source reports

CVE List Score used 3.1

etcd key name can be accessed via LeaseTimeToLive API

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

Record
CVE-2023-32082
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2023-1459 3.1

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

Record
EUVD-2023-1459
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-3p4g-rcw5-8298 3.1

etcd Key name can be accessed via LeaseTimeToLive API

Impact

LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).

Patches

< v3.4.26 and < v3.5.9 are affected.

Workarounds

No.

Reporter

Yoni Rozenshein

Record
GHSA-3p4g-rcw5-8298
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 3.1

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

Record
CVE-2023-32082
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVAZL-26666 4.3

CVE-2023-32082 affecting package etcd for versions less than 3.5.3-10

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

Record
AZL-26666
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSV 3.1

etcd key name can be accessed via LeaseTimeToLive API

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

Record
CVE-2023-32082
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2023-32082 4.3

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

Record
DEBIAN-CVE-2023-32082
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVGHSA-3p4g-rcw5-8298 3.1

etcd Key name can be accessed via LeaseTimeToLive API

Impact

LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).

Patches

< v3.4.26 and < v3.5.9 are affected.

Workarounds

No.

Reporter

Yoni Rozenshein

Record
GHSA-3p4g-rcw5-8298
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVOESA-2025-1168 9.8

etcd security update

%{expand:

Security Fix(es):

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.(CVE-2022-34038)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)

Record
OESA-2025-1168
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1169 9.8

etcd security update

%{expand:

Security Fix(es):

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.(CVE-2022-34038)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)

Record
OESA-2025-1169
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1170 9.8

etcd security update

%{expand:

Security Fix(es):

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.(CVE-2022-34038)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)

Record
OESA-2025-1170
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:3441 9.8

Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (etcd) security update

Record
RHSA-2023:3441
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-32082 3.1

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

Record
UBUNTU-CVE-2023-32082
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVBIT-etcd-2023-32082 No score

etcd key name can be accessed via LeaseTimeToLive API

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

Record
BIT-etcd-2023-32082
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/etcd-io/etcd
Go
 before 3.4.26
3.4.26
github.com/etcd-io/etcd
Go
 3.5.0 up to 3.5.9
3.5.9
etcd
Azure Linux:2
 before 3.5.3-10
3.5.3-10
etcd
Bitnami
 before 3.4.26, 3.5.0 up to 3.5.9
3.4.263.5.9
etcd
Debian:12
 All versions, plus listed versions
3.4.23-43.4.23-53.4.23-63.4.30-13.4.30-2
Show 25 moreShow less
3.4.30-33.5.15-13.5.15-23.5.15-33.5.15-43.5.15-53.5.15-63.5.15-73.5.16-13.5.16-103.5.16-113.5.16-23.5.16-33.5.16-43.5.16-53.5.16-63.5.16-73.5.16-83.5.16-93.5.22-13.5.22-23.5.30-1~exp13.5.30-1~exp23.5.30-23.5.5-1
 None known
etcd
Debian:13
 before 3.4.30-1
3.4.30-1
etcd
Debian:14
 before 3.4.30-1
3.4.30-1
etcd
openEuler:20.03-LTS-SP4
From an advisory covering 5 CVEs
 before 3.4.14-9.oe2003sp4
3.4.14-9.oe2003sp4
etcd
openEuler:22.03-LTS-SP3
From an advisory covering 5 CVEs
 before 3.4.14-8.oe2203sp3
3.4.14-8.oe2203sp3
etcd
openEuler:22.03-LTS-SP4
From an advisory covering 5 CVEs
 before 3.4.14-11.oe2203sp4
3.4.14-11.oe2203sp4
Show 11 moreShow less
Affected packages
PackageAffectedFixed
etcd
Red Hat:openstack:17.0::el9
From an advisory covering 2 CVEs
 before 0:3.4.26-1.el9ost
0:3.4.26-1.el9ost
etcd-debuginfo
Red Hat:openstack:17.0::el9
From an advisory covering 2 CVEs
 before 0:3.4.26-1.el9ost
0:3.4.26-1.el9ost
etcd-debugsource
Red Hat:openstack:17.0::el9
From an advisory covering 2 CVEs
 before 0:3.4.26-1.el9ost
0:3.4.26-1.el9ost
etcd
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.2.0+dfsg-22.2.1+dfsg-12.2.2+dfsg-12.2.2+dfsg-22.2.3+dfsg-12.2.5+dfsg-12.2.5+dfsg-1ubuntu1
 None known
etcd
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.0-13.2.9+dfsg-23.2.9+dfsg-33.2.17+dfsg-13.2.17+dfsg-1ubuntu0.1~esm13.2.17+dfsg-1ubuntu0.13.2.17+dfsg-1ubuntu0.1+esm13.2.17+dfsg-1ubuntu0.1+esm2
 None known
etcd
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.2.26+dfsg-33.2.26+dfsg-43.2.26+dfsg-63.2.26+dfsg-6ubuntu0.13.2.26+dfsg-6ubuntu0.23.2.26+dfsg-6ubuntu0.2+esm1
 None known
etcd
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.3.25+dfsg-63.3.25+dfsg-73.3.25+dfsg-7ubuntu0.22.04.13.3.25+dfsg-7ubuntu0.22.04.1+esm13.3.25+dfsg-7ubuntu0.22.04.23.3.25+dfsg-7ubuntu0.22.04.2+esm13.3.25+dfsg-7ubuntu0.22.04.2+esm23.3.25+dfsg-7ubuntu0.22.04.2+esm3
 None known
etcd
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.4.23-4ubuntu23.4.30-13.4.30-1build13.4.30-1ubuntu0.24.04.13.4.30-1ubuntu0.24.04.2
Show 4 moreShow less
3.4.30-1ubuntu0.24.04.2+esm13.4.30-1ubuntu0.24.04.33.4.30-1ubuntu0.24.04.3+esm13.4.30-1ubuntu0.24.04.3+esm2
 None known
etcd
Ubuntu:25.10
 All versions, plus listed versions
3.5.16-4
 None known
etcd
Ubuntu:26.10
 All versions, plus listed versions
3.5.16-103.5.30-2
 None known
etcd
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.5.16-43.5.16-103.5.16-10ubuntu0.26.04.1~esm1
 None known

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-32082 is a low vulnerability (CVSS 3.1) in Etcd, published May 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in github.com/etcd-io/etcd 3.4.26.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open