Etcd · Etcd · CVE-2023-32082
**Name of the Vulnerable Software and Affected Versions**
etcd versions prior to 3.4.26 and prior to 3.5.9
**Description**
The issue is related to insufficient protection of service data in etcd, a distributed key-value store. The LeaseTimeToLive API allows access to key names associated with a lease when the `Keys` parameter is true, even if a user does not have read permission to the keys. This issue is limited to clusters that enable authentication (RBAC).
**Recommendations**
For versions prior to 3.4.26, update to version 3.4.26 or later.
For versions prior to 3.5.9, update to version 3.5.9 or later.
As a temporary workaround, consider disabling the LeaseTimeToLive API or restricting access to it until a patch is applied.
Restrict access to the `Keys` parameter in the LeaseTimeToLive API to minimize the risk of exploitation.