CVE-2020-15115Medium· 5.8▾ Sunlitetcd has no minimum password length
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.9 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.3%
Access Control
The etcdctl and etcd API do not enforce a specific password length during user creation or user password update operations. It is the responsibility of the administrator to enforce these requirements.
etcd does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users’ passwords with little computational effort.
Find out more on this vulnerability in the security audit report
If you have any questions or comments about this advisory:
go.etcd.io/etcd/client/v3 >= 3.4.0, < 3.4.10go.etcd.io/etcd/client/v3 < 3.3.23Upgrade to a patched release:
go.etcd.io/etcd/client/v3 3.4.10go.etcd.io/etcd/client/v3 3.3.23Connected by shared product, vendor, weakness, or advisory.
CVE-2020-15106Medium· 5.3etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic
GHSA-5x4g-q5rc-36jpLowEtcd pkg Insecure ciphers are allowed by default
CVE-2020-15114High· 7.7Etcd Gateway can include itself as an endpoint resulting in resource exhaustion
CVE-2026-73499Highetcd is a distributed key-value store for the data of a distributed system
GHSA-6vch-q96h-7gc3Highetcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
GHSA-xg4h-6gfc-h4m8Highetcd: Watch API authorization bypass via open-ended range requests