etcd
v3.7.3Distributed reliable key-value store for the most critical data of a distributed system
- Maintenance
- Active227 commits in 3 months · bus factor 4
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 20 advisories1 high, 10 medium, 9 low · Scorecard 6.9/10
- Supported versions
- 3 lines supportednewest 3.7 · oldest 3.5 until Jul 8, 2027 · 5 ended
52.6k stars · 10.6k forks · 467 open issues · last release 23 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 20 most recent advisories published by the maintainers: 1 high, 10 medium, 9 low. Check the patched version against the one you run.
- mediumCVE-2026-73500Jul 23, 2026`tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
- Affected
- <=3.7.0; <=3.6.13; <=3.5.32
- Patched in
- 3.7.1; 3.6.14; 3.5.33
- mediumCVE-2026-73499Jul 23, 2026Watch API authorization bypass via open-ended range requests
- Affected
- <=3.7.0; <=3.6.13; <=3.5.32
- Patched in
- 3.7.1; 3.6.14; 3.5.33
- mediumCVE-2026-59818Jul 1, 2026etcd: CRL enforcement bypass on gRPC listener when `--listen-client-http-urls` is configured
- Affected
- <=3.6.12; <=3.5.31
- Patched in
- 3.6.13; 3.5.32
- lowCVE-2026-44283May 1, 2026RBAC authorization bypass in etcd allows unauthorized data access via PrevKv or lease attachment in Put requests nested in transactions
- Affected
- <=3.6.10; <=3.5.29; <=3.4.43
- Patched in
- 3.6.11; 3.5.30; 3.4.44
- lowCVE-2026-33343Mar 20, 2026Nested etcd transactions bypass RBAC authorization checks
- Affected
- <=3.6.8; <=3.5.27; <=3.4.41
- Patched in
- 3.6.9; 3.5.28; 3.4.42
- mediumCVE-2026-33413Mar 20, 2026Authorization bypasses in multiple APIs
- Affected
- <=3.6.8; <=3.5.27; <=3.4.41
- Patched in
- 3.6.9; 3.5.28; 3.4.42
- lowCVE-2023-32082May 11, 2023Key name can be accessed via LeaseTimeToLive API
- Affected
- < v3.4.26 and < v3.5.9
- Patched in
- v3.4.26 and v3.5.9
- lowAug 5, 2020Inaccurate logging of authentication attempts for users with CN-based auth only
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- lowAug 5, 2020Auto compaction retention negative value causing a compaction loop or a crash
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- lowAug 5, 2020A negative value for cluster node size results in an index out-of-bound panic during service discovery
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- mediumAug 5, 2020Gateway TLS endpoint validation only confirms TCP reachability
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- mediumCVE-2020-15136Aug 5, 2020Gateway TLS authentication only applies to endpoints detected in DNS SRV records
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- highCVE-2020-15114Aug 5, 2020Gateway can include itself as an endpoint resulting in resource exhaustion
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- lowGHSA-5x4g-q5rc-36jpAug 5, 2020Insecure ciphers are allowed by default
- Affected
- <= 3.4.9
- Patched in
- 3.4.22
- mediumCVE-2020-15106Aug 5, 2020A large slice causes panic in decodeRecord method
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- lowAug 5, 2020User credentials are stored in WAL logs in plaintext
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- mediumCVE-2020-15115Aug 5, 2020No minimum password length
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- mediumCVE-2020-15112Aug 5, 2020An entry with large index causes panic in WAL ReadAll method
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- mediumCVE-2020-15113Aug 5, 2020Directories created via os.MkdirAll are not checked for permissions
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23
- lowAug 5, 2020TOCTOU of gateway endpoint authentication
- Affected
- <= 3.4.9
- Patched in
- 3.4.10, 3.3.23