CVE-2018-16886: Authentication bypass in go.etcd.io/etcd
Summary
CVE-2018-16886: Authentication bypass in go.etcd.io/etcd. Affects go.etcd.io/etcd versions < 0.5.0-alpha.5.0.20190108173120-83c051b701d3. Fixed in 0.5.0-alpha.5.0.20190108173120-83c051b701d3. How to fix ↓
Also tracked for
- go.etcd.io/etcd/v3 · Go
- etcd · Debian:11
The same CVE-2018-16886 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The go.etcd.io/etcd package is a Go library that provides a distributed key-value store for shared configuration and service discovery. It is commonly used in distributed systems and cloud-native applications. This package includes functionality for authentication and role-based access control (RBAC) to secure access to the key-value store.
Vulnerability Detail
A user can exploit a vulnerability in go.etcd.io/etcd that allows them to bypass authentication. By using a valid client certificate with a CommonName that matches a valid RBAC username, the user can authenticate themselves as that user without the required credentials. This vulnerability requires a certificate issued by a certificate authority (CA) trusted by the server. If successfully exploited, an attacker could gain unauthorized access to the key-value store and perform actions on behalf of the authenticated user.
How To Fix
Latest published version: v3.3.27+incompatible as of 22 Oct 2026
go get go.etcd.io/etcd@v3.3.27+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0-alpha.5.0.20190108173120-83c051b701d3
This is the first release that contains the fix.
go get go.etcd.io/etcd@v0.5.0-alpha.5.0.20190108173120-83c051b701d3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
The authentication bypass vulnerability in go.etcd.io/etcd allows an attacker to impersonate a valid RBAC user and gain unauthorized access to the key-value store. It is crucial to upgrade to the patched version and validate client certificates properly to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for go.etcd.io/etcd →
FAQ
go.etcd.io/etcd is a Go library that provides a distributed key-value store for shared configuration and service discovery.
RBAC stands for Role-Based Access Control. It is a method of regulating access to computer resources based on the roles assigned to individual users.
The vulnerability allows a user to authenticate themselves as a valid RBAC user by using a client certificate with a matching CommonName, even without the required credentials.
If exploited, an attacker could gain unauthorized access to the key-value store and perform actions on behalf of the authenticated user.
To fix this vulnerability, upgrade to version 0.5.0-alpha.5.0.20190108173120-83c051b701d3 or later of go.etcd.io/etcd and ensure proper validation of client certificates.
References
Related vulnerabilities
Recent vulnerabilities recorded for go.etcd.io/etcd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
