Every CVE Search/ Get API key

CVE-2018-16886

go.etcd.io/etcd Authentication Bypass

6.8 MediumFix available

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

4.06%Up 1.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.8

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Record
CVE-2018-16886
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2022-1756 6.8

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Record
EUVD-2022-1756
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-h6xx-pmxh-3wgp 8.1

go.etcd.io/etcd Authentication Bypass

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Record
GHSA-h6xx-pmxh-3wgp
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-285, CWE-287
Updated
2026-11-02
NVD 8.1

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Record
CVE-2018-16886
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
OSV 8.1

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Record
CVE-2018-16886
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-16886 8.1

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Record
DEBIAN-CVE-2018-16886
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-h6xx-pmxh-3wgp 8.1

go.etcd.io/etcd Authentication Bypass

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Record
GHSA-h6xx-pmxh-3wgp
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-285, CWE-287
Updated
2026-11-02
OSVRHSA-2019:1352 6.8

Red Hat Security Advisory: etcd security, bug fix, and enhancement update

Record
RHSA-2019:1352
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2018-16886 8.1

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Record
UBUNTU-CVE-2018-16886
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVGO-2021-0077 No score

Authentication bypass in go.etcd.io/etcd

A user can use a valid client certificate that contains a CommonName that matches a valid RBAC username to authenticate themselves as that user, despite lacking the required credentials. This may allow authentication bypass, but requires a certificate that is issued by a CA trusted by the server.

Record
GO-2021-0077
Updated
2026-11-02
OSVopenSUSE-SU-2024:10741-1 No score

etcd-3.4.16-3.1 on GA media

These are all security issues fixed in the etcd-3.4.16-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10741-1
Updated
2026-11-02
OSVSUSE-SU-2024:3656-1 No score

Security update for etcd

This update for etcd fixes the following issues:

Update to version 3.5.12:

Security fixes:

  • CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)
  • CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)
  • CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)
  • CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled (bsc#1121850)
  • CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)
  • CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)
  • CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)
  • CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)
  • CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)
  • CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)
  • CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in crypto/ssh (bsc#1217950, bsc#1218150)

Other changes:

  • Added hardening to systemd service(s) (bsc#1181400)
  • Fixed static /tmp file issue (bsc#1199031)
  • Fixed systemd service not starting (bsc#1183703)

Full changelog:

https://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12

Record
SUSE-SU-2024:3656-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
go.etcd.io/etcd/v3
Go
 3.2.0 up to 3.2.26
3.2.26
go.etcd.io/etcd/v3
Go
 3.3.0 up to 3.3.11
3.3.11
go.etcd.io/etcd
Go
 before 0.5.0-alpha.5.0.20190108173120-83c051b701d3
0.5.0-alpha.5.0.20190108173120-83c051b701d3
etcd
Debian:12
 before 3.2.26+dfsg-1
3.2.26+dfsg-1
etcd
Debian:13
 before 3.2.26+dfsg-1
3.2.26+dfsg-1
etcd
Debian:14
 before 3.2.26+dfsg-1
3.2.26+dfsg-1
etcd
Red Hat:rhel_extras_other:7
 before 0:3.2.26-1.el7
0:3.2.26-1.el7
etcd-debuginfo
Red Hat:rhel_extras_other:7
 before 0:3.2.26-1.el7
0:3.2.26-1.el7
etcd
openSUSE:Leap 15.5
From an advisory covering 11 CVEs
 before 3.5.12-150000.7.6.1
3.5.12-150000.7.6.1
etcd
openSUSE:Leap 15.6
From an advisory covering 11 CVEs
 before 3.5.12-150000.7.6.1
3.5.12-150000.7.6.1
etcd
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.0-13.2.9+dfsg-23.2.9+dfsg-33.2.17+dfsg-13.2.17+dfsg-1ubuntu0.1~esm13.2.17+dfsg-1ubuntu0.13.2.17+dfsg-1ubuntu0.1+esm13.2.17+dfsg-1ubuntu0.1+esm2
 None known
etcd
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 3.4.16-3.1
3.4.16-3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-16886 is a medium vulnerability (CVSS 6.8) in Etcd, published January 14, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.06%, the 90th percentile. Fixed in go.etcd.io/etcd/v3 3.2.26.

References

Show 51 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open