CVE-2018-16886 is a high-severity (CVSS 8.1) Improper Authentication vulnerability in go.etcd.io/etcd/v3. A fix is available for go.etcd.io/etcd/v3 — see the affected versions and patch details below.
go.etcd.io/etcd Authentication Bypass
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
go.etcd.io/etcd/v3🐹go.etcd.io/etcd/v3🐹go.etcd.io/etcdReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | go.etcd.io/etcd/v3 | ≥ 3.2.0&&< 3.2.26 | 3.2.26go get go.etcd.io/etcd/v3@v3.2.26 |
| 🐹Go | go.etcd.io/etcd/v3 | ≥ 3.3.0&&< 3.3.11 | 3.3.11go get go.etcd.io/etcd/v3@v3.3.11 |
| 🐹Go | go.etcd.io/etcd | all versions | 0.5.0-alpha.5.0.20190108173120-83c051b701d3go get go.etcd.io/etcd@v0.5.0-alpha.5.0.20190108173120-83c051b701d3 |
Affected Products
etcdetcdfedorafedoraprojectenterprise linux desktopredhatenterprise linux serverredhatenterprise linux workstationredhatDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for go.etcd.io/etcd/v3, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update go.etcd.io/etcd/v3 to 3.2.26 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2018-16886 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
OpenShift Container Platform 3.x, and 4.1 versions do not use etcd Role-based access control so they are not affected.
Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it. To check the CN field of a certificate: openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*' To check if there is a username matching the CN field in the TLS client certificate: etcdctl user get <TLS client certificate CN> For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation:…Source: Red Hat security advisory for CVE-2018-16886 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux 7 Extras | etcd-0:3.2.26-1.el7 | RHSA-2019:1352 |
Frequently Asked Questions
Is CVE-2018-16886 in your dependencies?
Find it across Go, including transitive dependencies.