# go.etcd.io/etcd (Go) vulnerabilities 9 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v3.3.27+incompatible (Oct 15, 2021): affected by 4 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 240 since v0.1.0 (Aug 11, 2013) - Registry: https://pkg.go.dev/go.etcd.io/etcd - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-44283: v0.1.0 to v3.3.27+incompatible (through the newest release) - CVE-2026-33413: v0.1.0 to v3.3.27+incompatible (through the newest release) - CVE-2026-33343: v0.1.0 to v3.3.27+incompatible (through the newest release) - CVE-2020-15136: v0.1.0 to v3.3.23-0.20200624111051-999df4e5a1a2+incompatible (v3.3.24+incompatible is outside it) - CVE-2020-15114: v0.1.0 to v3.3.23-0.20200624111051-999df4e5a1a2+incompatible (v3.3.24+incompatible is outside it) - CVE-2020-15112: v0.1.0 to v0.5.0-alpha.5 (v2.0.0-rc.1+incompatible is outside it) - CVE-2020-15106: v0.1.0 to v0.5.0-alpha.5 (v2.0.0-rc.1+incompatible is outside it) - CVE-2018-16886: v0.1.0 to v0.5.0-alpha.5 (v2.0.0-rc.1+incompatible is outside it) - CVE-2018-1099: v0.1.0 to v3.3.27+incompatible (through the newest release) ## Advisories (9) ### [CVE-2026-44283](https://cve.now/CVE-2026-44283): etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks - Severity: None 0.0 - Published: May 14, 2026 - Affected: fixed in 3.4.44. - No fix released. The advisory names 3.4.44 as the fix, which the registry doesn't have yet. The latest release, v3.3.27+incompatible, is still affected. ### [CVE-2026-33413](https://cve.now/CVE-2026-33413): etcd: Authorization bypasses in multiple APIs - Severity: High 8.8 - Published: Mar 26, 2026 - Affected: all versions; through 3.3.27. - No fix released. The latest release, v3.3.27+incompatible, is still affected. ### [CVE-2026-33343](https://cve.now/CVE-2026-33343): etcd: Nested etcd transactions bypass RBAC authorization checks - Severity: None 0.0 - Published: Mar 26, 2026 - Affected: through 3.3.27; all versions. - No fix released. The latest release, v3.3.27+incompatible, is still affected. ### [CVE-2020-15136](https://cve.now/CVE-2020-15136): Improper authentication in etcd - Severity: Medium 6.5 - Published: Aug 6, 2020 - Affected: from 3.4.0-rc.0, fixed in 3.4.10; fixed in 3.3.23. - Fixed in v3.3.24+incompatible (released Aug 18, 2020, 12 days after disclosure, the advisory names 3.3.23, which was never published). - The latest release, v3.3.27+incompatible, is not affected. ### [CVE-2020-15114](https://cve.now/CVE-2020-15114): Denial of Service in etcd - Severity: High 7.7 - Published: Aug 6, 2020 - Affected: from 3.4.0-rc.0, fixed in 3.4.10; fixed in 3.3.23. - Fixed in v3.3.24+incompatible (released Aug 18, 2020, 12 days after disclosure, the advisory names 3.3.23, which was never published). - The latest release, v3.3.27+incompatible, is not affected. ### [CVE-2020-15112](https://cve.now/CVE-2020-15112): Improper Input Validation in etcd - Severity: Medium 6.5 - Published: Aug 5, 2020 - Affected: fixed in 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4. - Fixed in v2.0.0+incompatible (released Jan 28, 2015, 2016 days before disclosure, the advisory names 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4, which was never published). - The latest release, v3.3.27+incompatible, is not affected. ### [CVE-2020-15106](https://cve.now/CVE-2020-15106): Improper Input Validation in etcd - Severity: Medium 6.5 - Published: Aug 5, 2020 - Affected: fixed in 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4. - Fixed in v2.0.0+incompatible (released Jan 28, 2015, 2016 days before disclosure, the advisory names 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4, which was never published). - The latest release, v3.3.27+incompatible, is not affected. ### [CVE-2018-16886](https://cve.now/CVE-2018-16886): etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access… - Severity: Medium 6.8 - Published: Jan 14, 2019 - Affected: fixed in 0.5.0-alpha.5.0.20190108173120-83c051b701d3. - Fixed in v2.0.0+incompatible (released Jan 28, 2015, 1447 days before disclosure, the advisory names 0.5.0-alpha.5.0.20190108173120-83c051b701d3, which was never published). - The latest release, v3.3.27+incompatible, is not affected. ### [CVE-2018-1099](https://cve.now/CVE-2018-1099): DNS rebinding vulnerability found in etcd 3.3.1 and earlier. - Severity: Unrated - Published: Apr 3, 2018 - Affected: fixed in 3.4.0. - No fix released. The advisory names 3.4.0 as the fix, which the registry doesn't have yet. The latest release, v3.3.27+incompatible, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/go.etcd.io/etcd Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.