UpHeron
All vulnerabilities

Servers and applications

CVE-2023-32082

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no…

Severity
Medium 4.3
Published
11 May 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.4.26, 3.5.9
Sources
NVD

Affected software

SoftwareAffected versions
etcdServers and applications · cpe:a:etcd:etcd
  • Every version before 3.4.26
  • From 3.5.0 before 3.5.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-32082
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-32082