Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

etcd-io/etcd

              main @ 61d518f
            

Fixes

CVEs

CRITICAL

Peak severity

34.4%

Coverage

Highlights

Auth Bypass: 27 prior fixes. Scrutinize any change in this area.

auth: most-fixed (6 issues). Treat as high-risk during review.

25 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recursive transaction operations and complex write paths (e.g., put requests with leases or PrevKv) historically bypassed core RBAC authorization checks, allowing authenticated users to access unauthorized data.

Auth Bypass: Exposed maintenance RPC endpoints (such as Defragment, Snapshot, and Downgrade) failed to validate administrator permissions properly, leaving sensitive management functions unguarded.

SSRF: HTTP clients used for internal peer-to-peer communications and member version checks followed HTTP redirects, creating server-side request forgery vectors.