CVE-2023-32082 etcd key name can be accessed via LeaseTimeToLive API
Attackers with limited permissions can read key names via the LeaseTimeToLive API in etcd clusters with authentication enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32082?
CVE-2023-32082 is a low-severity vulnerability in etcd-io etcd, published on 11 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
Weakness: CWE-200
Which versions are affected by CVE-2023-32082?
5 open source packages ship an affected version, including github.com/etcd-io/etcd and etcd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/etcd-io/etcd Go | All versions | 3.4.26 |
github.com/etcd-io/etcd Go | All versions | 3.4.26 |
github.com/etcd-io/etcd Go | From 3.5.0 | 3.5.9 |
github.com/etcd-io/etcd Go | From 3.5.0 | 3.5.9 |
etcd Bitnami | All versions | 3.4.26, 3.5.9 |
Products include Etcd Etcd.
How do I fix CVE-2023-32082?
Upgrade github.com/etcd-io/etcd to a fixed version for your release line: 3.4.26 or 3.5.9.
Is CVE-2023-32082 being exploited?
There is no known exploitation of CVE-2023-32082 in the wild and no public exploit code.
Other vulnerabilities in etcd-io etcd
- CVE-2021-28235 Etcd-io Improper Authentication vulnerability
- CVE-2026-33413 etcd: Authorization bypasses in multiple APIs
- CVE-2022-34038 Denial of service in n/a
- CVE-2018-16886 go.etcd.io/etcd Authentication Bypass
- CVE-2026-59818 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
Sources
Also known as AZL-26666, BIT-etcd-2023-32082, DEBIAN-CVE-2023-32082, GHSA-3p4g-rcw5-8298, UBUNTU-CVE-2023-32082.