CVE-2020-15136

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

• CWE-287
• CWE-306

• https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.mdBroken Link
• https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35qThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
• https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.mdBroken Link
• https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35qThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/

Published

Aug 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15130In SLPJS (npm package slpjs) before version 0.27.4, there is…7.5
• CVE-2020-15131In SLP Validate (npm package slp-validate) before version 1.…7.5
• CVE-2020-15132In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the …5.3
• CVE-2020-15133In faye-websocket before version 0.11.0, there is a lack of …8.7
• CVE-2020-15134Faye before version 1.4.0, there is a lack of certification …8.7
• CVE-2020-15135save-server (npm package) before version 1.05 is affected by…7.6
• CVE-2020-15137All versions of HoRNDIS are affected by an integer overflow …5.9
• CVE-2020-15138Prism is vulnerable to Cross-Site Scripting. The easing prev…7.5
• CVE-2020-15139In MyBB before version 1.8.24, the custom MyCode (BBCode) fo…6.1
• CVE-2020-1514<p>A cross-site-scripting (XSS) vulnerability exists when Mi…5.4
• CVE-2020-15140In Red Discord Bot before version 3.3.11, a RCE exploit has …9.6
• CVE-2020-15141In openapi-python-client before version 0.5.3, there is a pa…4.1