GHSA-h8g9-6gvh-5mrc
etcd vulnerable to TOCTOU of gateway endpoint authentication
GHSA-h8g9-6gvh-5mrc is a vulnerability with no CVSS score yet in go.etcd.io/etcd/v3, published October 6, 2022. No source lists public exploit code. Fixed in go.etcd.io/etcd/v3 3.4.10.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.4.10go.etcd.io/etcd/v3 +1 more
Description
Vulnerability type
Authentication
Workarounds
Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.
Detail
The gateway only authenticates endpoints detected from DNS SRV records, and it only authenticates the detected endpoints once. Therefore, if an endpoint changes its authentication settings, the gateway will continue to assume the endpoint is still authenticated. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.
References
Find out more on this vulnerability in the security audit report
For more information
If you have any questions or comments about this advisory:
- Contact the etcd security committee
Affected packages
| Package | Affected | Fixed |
|---|---|---|
go.etcd.io/etcd/v3Go | 3.4.0 up to 3.4.10 | 3.4.10 |
go.etcd.io/etcd/v3Go | before 3.3.23 | 3.3.23 |
What each source reports
GitHub AdvisoriesNo score
etcd vulnerable to TOCTOU of gateway endpoint authentication
Vulnerability type
Authentication
Workarounds
Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.
Detail
The gateway only authenticates endpoints detected from DNS SRV records, and it only authenticates the detected endpoints once. Therefore, if an endpoint changes its authentication settings, the gateway will continue to assume the endpoint is still authenticated. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.
References
Find out more on this vulnerability in the security audit report
For more information
If you have any questions or comments about this advisory:
- Contact the etcd security committee
- Record
GHSA-h8g9-6gvh-5mrc- Weakness
- CWE-367
- Updated
- 2026-11-02
OSVNo score
etcd vulnerable to TOCTOU of gateway endpoint authentication
Vulnerability type
Authentication
Workarounds
Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.
Detail
The gateway only authenticates endpoints detected from DNS SRV records, and it only authenticates the detected endpoints once. Therefore, if an endpoint changes its authentication settings, the gateway will continue to assume the endpoint is still authenticated. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.
References
Find out more on this vulnerability in the security audit report
For more information
If you have any questions or comments about this advisory:
- Contact the etcd security committee
- Record
GHSA-h8g9-6gvh-5mrc- Weakness
- CWE-367
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.