---
id: CVE-2020-15115
aliases:
  - GHSA-4993-m7g5-r9hh
title: etcd has no minimum password length
summary: etcd has no minimum password length
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'
vendor: etcd
product: go.etcd.io/etcd/client/v3
ecosystem: go
affected:
  - 'go.etcd.io/etcd/client/v3 >= 3.4.0, < 3.4.10'
  - go.etcd.io/etcd/client/v3 < 3.3.23
patched:
  - go.etcd.io/etcd/client/v3 3.4.10
  - go.etcd.io/etcd/client/v3 3.3.23
published: '2022-10-06'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:46.233984521Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4993-m7g5-r9hh'
references:
  - url: 'https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-15115'
  - url: 'https://github.com/etcd-io/etcd'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP
tags:
  - osv
  - go
epss: 0.01342
epssPercentile: 0.70166
ingestedAt: '2026-09-12T03:13:01.752Z'
---

## Overview

### Vulnerability type
Access Control

### Workarounds
The etcdctl and etcd API do not enforce a specific password length during user creation or user password update operations. [It is the responsibility of the administrator to enforce these requirements](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md#notes-on-password-strength).

### Detail
etcd does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users’ passwords with little computational effort.

### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)

### For more information
If you have any questions or comments about this advisory:
* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)

## Affected packages

- `go.etcd.io/etcd/client/v3 >= 3.4.0, < 3.4.10`
- `go.etcd.io/etcd/client/v3 < 3.3.23`

## Remediation

Upgrade to a patched release:

- `go.etcd.io/etcd/client/v3 3.4.10`
- `go.etcd.io/etcd/client/v3 3.3.23`