etcd-io/etcd Security Advisories | GitStock

high2026-07-24

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

GHSA-6vch-q96h-7gc3 · CVE-2026-73500

high2026-07-24

etcd: Watch API authorization bypass via open-ended range requests

GHSA-xg4h-6gfc-h4m8 · CVE-2026-73499

low2026-05-07

etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

GHSA-x35m-3gp4-4fh5 · CVE-2026-44283

high2026-03-20

etcd: Authorization bypasses in multiple APIs

GHSA-q8m4-xhhv-38mg · CVE-2026-33413

low2026-03-20

etcd: Nested etcd transactions bypass RBAC authorization checks

GHSA-rfx7-8w68-q57q · CVE-2026-33343

low2024-02-03

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only

GHSA-vjg6-93fv-qv64

low2024-02-03

Etcd embed auto compaction retention negative value causing a compaction loop or a crash

GHSA-pm3m-32r3-7mfh

low2024-02-03

Etcd pkg Insecure ciphers are allowed by default

GHSA-5x4g-q5rc-36jp

low2023-05-12

etcd Key name can be accessed via LeaseTimeToLive API

GHSA-3p4g-rcw5-8298 · CVE-2023-32082

critical2023-04-04

Etcd-io Improper Authentication vulnerability

GHSA-gmph-wf7j-9gcm · CVE-2021-28235

low2023-02-07

Panic due to malformed WALs in go.etcd.io/etcd

GHSA-p4g4-wgrh-qrg2 · CVE-2020-15106

low2022-10-06

etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery

GHSA-9gp7-6833-wv89

low2022-10-06

etcd user credentials are stored in WAL logs in plaintext

GHSA-528j-9r78-wffx

medium2022-10-06

etcd has no minimum password length

GHSA-4993-m7g5-r9hh · CVE-2020-15115

low2022-10-06

etcd vulnerable to TOCTOU of gateway endpoint authentication

GHSA-h8g9-6gvh-5mrc

medium2022-10-06

etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic

GHSA-m332-53r6-2w93 · CVE-2020-15112