Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-32082

18
FAUCET Score

CVE-2023-32082 is a medium-severity information disclosure vulnerability affecting etcd versions prior to 3.4.26 and 3.5.9. It allows authenticated users with limited permissions to discover key names associated with a lease, even without explicit read access to those keys, when the LeaseTimeToLive API's "Keys" parameter is set to true. The attack vector is network-based with low complexity, requiring low privileges, and results in a limited confidentiality impact (CVSS 4.3). There is no evidence of active exploitation, public exploit code, or significant community discussion, with the vulnerability not listed in the CISA KEV catalog.

Impacted Technologies

VendorProductVersion(s)CPE
< 3.4.26CPE matchmatch criteria
cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*
>= 3.5.0, < 3.5.9CPE matchmatch criteria
cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

3.1LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
1.6
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.74%
Probability of exploitation in next 30 days
EPSS Percentile
51.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0074 is in the 62nd percentile among its peer group of 21,954 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (9)

github_advisorypatch availablevia nvd_reference
View patch
gopatch availablevia ghsa
Product: github.com/etcd-io/etcdFixed in: 3.4.26
gopatch availablevia ghsa
Product: github.com/etcd-io/etcdFixed in: 3.5.9
microsoftpatch availablevia msrc
Product: cbl2 etcd 3.5.3-10 on CBL Mariner 2.0Fixed in: 3.5.3-10
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 17.0Fixed in: etcd-0:3.4.26-1.el9ost
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 16.1Fixed in: etcd
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: etcd
redhatvendor investigatingvia redhat_api
Product: Red Hat Storage 3Fixed in: etcd
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-etcd

Vendor Advisories (3)

goGHSA-3p4g-rcw5-8298low

etcd Key name can be accessed via LeaseTimeToLive API

May 12, 2023
redhatCVE-2023-32082Low

etcd: Key name can be accessed via LeaseTimeToLive API

May 11, 2023
microsoft2023-May/CVE-2023-32082Moderate

etcd key name can be accessed via LeaseTimeToLive API

May 9, 2023

References

github.com / etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.md
Release Notes
github.com / etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md
Release Notes
github.com / etcd-io/etcd/pull/15656
Issue TrackingPatch
github.com / etcd-io/etcd/security/advisories/GHSA-3p4g-rcw5-8298
Vendor Advisory