etcd-unauth: ETCD Unauth

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://etcd.io/blog/2026/mar20-patch-release/
• https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg
• https://www.rapid7.com/db/vulnerabilities/http-etcd-unauthenticated-api-data-leak/
• https://github.com/etcd-io/etcd/issues/9475
• https://hackviser.com/tactics/pentesting/services/etcd
• https://cybertechnologyinsights.com/cybersecurity/etcd-vulnerability-unauthorized-api-access-security/
• https://nvd.nist.gov/vuln/detail/CVE-2026-33413
• https://cve.imfht.com/poc_detail/5af208f771c8c3313d97fa478dd1e069e4ed8ac2
• https://github.com/HXSecurity/TerraformGoat/releases
• https://www.cnblogs.com/qtzd/p/k8s_etcd.html

Related Vulnerabilities

• PoCflowise-chatflows-exposure: Flowise AI - Unauthenticated Chatflows API Exposure
• PoClangflow-api-exposure: Langflow - Unauthenticated API Exposure
• PoCCVE-2025-51683: mJobTime <= 15.7.2 - Unauthenticated Blind SQL Injection to RCE
• PoCCVE-2026-0561: Shield Security <= 21.0.8 - Unauthenticated Reflected XSS
• PoCCVE-2026-0768: Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code
• PoCCVE-2026-1281: Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection
• PoCCVE-2026-19092: Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation
• PoCCVE-2026-19632: TranslatePress <= 3.3.1 - Unauthenticated Account Takeover
• PoCCVE-2026-21875: ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection
• PoCCVE-2026-23693: ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy
• PoCCVE-2026-28411: WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()
• PoCCVE-2026-29963: HSC MailInspector - Unauthenticated Arbitrary File Read
• PoCCVE-2026-41948: Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal