CVE-2023-32082
mediumpriority · track · 17EPSS 0.007 · 55 %ileDEEURUUSEPSS · scored 2026-10-27
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.1–4.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (24)
Products and version ranges known to be affected.
- Red Hat OpenShift Container Platform < 4.12.21all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.12.21
- Red Hat OpenShift Container Platform < 4.13.3all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.13.3
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-1373Red Hat OpenStack Platform : Mehrere SchwachstellenDeutsch2023-06-05csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in der Red Hat OpenStack Platform ausnutzen, um seine Privilegien zu erhöhen, einen Denial of Service zu verursachen oder Informationen offenzulegen.
- GHSA-3p4g-rcw5-8298etcd Key name can be accessed via LeaseTimeToLive API2023-05-12ghsa · osvUS
### Impact LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). ### Patches < v3.4.26 and < v3.5.9 are affected. ### Workarounds No. ### Reporter Yoni Rozenshein
- BIT-etcd-2023-32082etcd key name can be accessed via LeaseTimeToLive API2024-03-06vendor · osvUS
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (14)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-32082/cnnvd
- https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.mdcnnvd
- https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.mdcnnvd
- https://github.com/etcd-io/etcd/pull/15656cnnvd
- https://github.com/etcd-io/etcd/security/advisories/GHSA-3p4g-rcw5-8298cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.3218cnnvd
- https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.mdenisa_euvd
- https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.mdenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan