-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/etcd-io/etcd | go | < 3.4.26 | 3.4.26 |
| github.com/etcd-io/etcd | go | >= 3.5.0, < 3.5.9 | 3.5.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the LeaseTimeToLive API endpoint not enforcing RBAC checks on key names when returning lease-associated keys. The GitHub PR #15656 explicitly shows added permission checks in the LeaseTimeToLive handler, confirming the function was missing authorization validation for key enumeration. The CHANGELOG entries for the patched versions (3.4.26/3.5.9) directly reference this fix, and the CWE-200 classification aligns with unauthorized information exposure through this endpoint.