CVE-2018-16886 go.etcd.io/etcd Authentication Bypass
Attackers can bypass authentication and gain unauthorized access to etcd data if RBAC and client-cert-auth are enabled with matching Common Names.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16886?
CVE-2018-16886 is a medium-severity authentication bypass vulnerability in Fedoraproject Fedora, published on 14 Jan 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
Weakness: CWE-287
Which versions are affected by CVE-2018-16886?
7 open source packages ship an affected version, including go.etcd.io/etcd/v3 and go.etcd.io/etcd. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
go.etcd.io/etcd/v3 Go | From 3.2.0 | 3.2.26 |
go.etcd.io/etcd/v3 Go | From 3.2.0 | 3.2.26 |
go.etcd.io/etcd/v3 Go | From 3.3.0 | 3.3.11 |
go.etcd.io/etcd/v3 Go | From 3.3.0 | 3.3.11 |
go.etcd.io/etcd Go | All versions | 0.5.0-alpha.5.0.20190108173120-83c051b701d3 |
go.etcd.io/etcd Go | All versions | 0.5.0-alpha.5.0.20190108173120-83c051b701d3 |
1 more packages
go.etcd.io/etcd Go | All versions | 0.5.0-alpha.5.0.20190108173120-83c051b701d3 |
Linux distribution packages (2)
etcd Red Hat:rhel_extras_other:7 | All versions | 0:3.2.26-1.el7 |
etcd-debuginfo Red Hat:rhel_extras_other:7 | All versions | 0:3.2.26-1.el7 |
Products include Etcd Etcd, Fedoraproject Fedora, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2018-16886?
Upgrade go.etcd.io/etcd/v3 to a fixed version for your release line: 3.2.26 or 3.3.11.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-16886 being exploited?
There is no known exploitation of CVE-2018-16886 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2021-28235 Etcd-io Improper Authentication vulnerability
- CVE-2026-33413 etcd: Authorization bypasses in multiple APIs
- CVE-2022-34038 Denial of service in n/a
- CVE-2026-59818 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
- CVE-2020-15106 Improper Input Validation in etcd
Sources
Also known as DEBIAN-CVE-2018-16886, GHSA-h6xx-pmxh-3wgp, GO-2021-0077, RHSA-2019:1352, UBUNTU-CVE-2018-16886.