{"id":"CVE-2018-16886","aliases":["DEBIAN-CVE-2018-16886","EUVD-2022-1756","GHSA-h6xx-pmxh-3wgp","GO-2021-0077","RHSA-2019:1352","SUSE-SU-2024:3656-1","UBUNTU-CVE-2018-16886","openSUSE-SU-2024:10741-1"],"status":"published","title":"go.etcd.io/etcd Authentication Bypass","description":"etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.","severity":{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.04064,"percentile":0.90741,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-287"],"published":"2019-01-14T19:00:00Z","modified":"2026-10-23T18:03:01Z","fixes":[{"ecosystem":"Go","package":"go.etcd.io/etcd/v3","fixed_in":["3.2.26","3.3.11"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"go.etcd.io/etcd","fixed_in":["0.5.0-alpha.5.0.20190108173120-83c051b701d3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"etcd","fixed_in":["3.2.26+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"etcd","fixed_in":["3.2.26+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"etcd","fixed_in":["3.2.26+dfsg-1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"etcd","fixed_in":["0:3.2.26-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"etcd-debuginfo","fixed_in":["0:3.2.26-1.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"go.etcd.io/etcd/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.26"}]}]},{"source":"ghsa","ecosystem":"Go","package":"go.etcd.io/etcd/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.11"}]}]},{"source":"ghsa","ecosystem":"Go","package":"go.etcd.io/etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-alpha.5.0.20190108173120-83c051b701d3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.26+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.26+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.26+dfsg-1"}]}]},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.0"},{"fixed":"3.2.26"}]}]},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.3.0"},{"fixed":"3.3.11"}]}]},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.0-alpha.5.0.20190108173120-83c051b701d3"}]}]},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.0-alpha.5.0.20190108173120-83c051b701d3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.26-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.26-1.el7"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.7.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.7.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-1","3.2.9+dfsg-2","3.2.9+dfsg-3","3.2.17+dfsg-1","3.2.17+dfsg-1ubuntu0.1~esm1","3.2.17+dfsg-1ubuntu0.1","3.2.17+dfsg-1ubuntu0.1+esm1","3.2.17+dfsg-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.16-3.1"}]}],"bundled":5}],"products":[{"vendor":"etcd","product":"etcd"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"the etcd project","product":"etcd:"}],"references":[{"url":"https://github.com/etcd-io/etcd/blob/1eee465a43720d713bb69f7b7f5e120135fdb1ac/CHANGELOG-3.3.md#security-authentication","tags":["x_refsource_MISC","x_transferred","Release Notes","advisory","web"]},{"url":"http://www.securityfocus.com/bid/106540","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://github.com/etcd-io/etcd/blob/1eee465a43720d713bb69f7b7f5e120135fdb1ac/CHANGELOG-3.2.md#security-authentication","tags":["x_refsource_MISC","x_transferred","Release Notes","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0237","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16886","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1352","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16886","tags":["advisory"]},{"url":"https://github.com/etcd-io/etcd/pull/10366","tags":["web","fix","report"]},{"url":"https://github.com/etcd-io/etcd/commit/0191509637546621d6f2e18e074e955ab8ef374d","tags":["web"]},{"url":"https://github.com/etcd-io/etcd/commit/bf9d0d8291dc71ecbfb2690612954e1a298154b2","tags":["web","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/"},{"url":"https://pkg.go.dev/vuln/GO-2021-0077","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h6xx-pmxh-3wgp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-16886","tags":["advisory"]},{"url":"https://github.com/etcd-io/etcd","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676902","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1352.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16886","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243656-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1095184","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1121850","tags":["report"]},{"url":"https://bugzilla.suse.com/1174951","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1183703","tags":["report"]},{"url":"https://bugzilla.suse.com/1199031","tags":["report"]},{"url":"https://bugzilla.suse.com/1208270","tags":["report"]},{"url":"https://bugzilla.suse.com/1208297","tags":["report"]},{"url":"https://bugzilla.suse.com/1210138","tags":["report"]},{"url":"https://bugzilla.suse.com/1213229","tags":["report"]},{"url":"https://bugzilla.suse.com/1217070","tags":["report"]},{"url":"https://bugzilla.suse.com/1217950","tags":["report"]},{"url":"https://bugzilla.suse.com/1218150","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-16886","tags":["report"]},{"url":"https://github.com/etcd-io/etcd/commit/a9a9466fb8ba11ad7bb6a44d7446fbd072d59887","tags":["report"]},{"url":"https://github.com/etcd-io/etcd/commit/99704e2a97e8710da942bdc737417fc9c9a2c03f","tags":["report"]},{"url":"https://github.com/etcd-io/etcd/commit/83c051b701d33261eef91a719e4421c81b000ba4","tags":["report"]},{"url":"https://github.com/etcd-io/etcd/pull/10386","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-16886","description":"etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.","status":"published","published":"2019-01-14T19:00:00Z","modified":"2024-08-05T10:32:54.152Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2022-1756","description":"etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.","status":"published","published":"2019-01-14T19:00:00Z","modified":"2024-08-05T10:32:54Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:40.316949Z"}],"ghsa":[{"id":"GHSA-h6xx-pmxh-3wgp","title":"go.etcd.io/etcd Authentication Bypass","description":"etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.","status":"published","published":"2022-04-12T22:41:32Z","modified":"2023-08-30T11:13:45Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-285","CWE-287"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2018-16886","description":"etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.","status":"published","published":"2019-01-14T19:29:00.243Z","modified":"2026-06-17T01:44:59.793Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:04:53.079938Z"}],"osv":[{"id":"CVE-2018-16886","description":"etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.","status":"published","published":"2019-01-14T19:29:00.243Z","modified":"2026-10-20T10:50:04.174693627Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-16886","description":"etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.","status":"published","published":"2019-01-14T19:29:00.243Z","modified":"2026-10-23T18:03:01.36624689Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"GHSA-h6xx-pmxh-3wgp","title":"go.etcd.io/etcd Authentication Bypass","description":"etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.","status":"published","published":"2022-04-12T22:41:32Z","modified":"2026-09-10T03:49:28.808778898Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-285","CWE-287"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"RHSA-2019:1352","title":"Red Hat Security Advisory: etcd security, bug fix, and enhancement update","status":"published","published":"2024-09-18T04:09:58Z","modified":"2026-02-21T10:02:49Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2018-16886","description":"etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.","status":"published","published":"2019-01-14T19:29:00Z","modified":"2025-09-08T16:45:01Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"GO-2021-0077","title":"Authentication bypass in go.etcd.io/etcd","description":"A user can use a valid client certificate that contains a CommonName that matches a valid RBAC username to authenticate themselves as that user, despite lacking the required credentials. This may allow authentication bypass, but requires a certificate that is issued by a CA trusted by the server.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2026-02-04T04:06:45.603231Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"openSUSE-SU-2024:10741-1","title":"etcd-3.4.16-3.1 on GA media","description":"These are all security issues fixed in the etcd-3.4.16-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:40:16.016886Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2024:3656-1","title":"Security update for etcd","description":"This update for etcd fixes the following issues:\n\nUpdate to version 3.5.12:\n\nSecurity fixes:\n\n- CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)\n- CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)\n- CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)\n- CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled (bsc#1121850)\n- CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)\n- CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)\n- CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)\n- CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)\n- CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)\n- CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)\n- CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in crypto/ssh (bsc#1217950, bsc#1218150)\n\nOther changes:\n\n- Added hardening to systemd service(s) (bsc#1181400)\n- Fixed static /tmp file issue (bsc#1199031)\n- Fixed systemd service not starting (bsc#1183703)\n\nFull changelog:\n\nhttps://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12\n","status":"published","published":"2024-10-16T11:33:42Z","modified":"2026-02-04T02:49:49.268837Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}