CVE-2021-28235: 
etcd vulnerability analysis and mitigation

An authentication vulnerability was discovered in Etcd-io version 3.4.10 that allows remote attackers to escalate privileges through the debug function. The vulnerability was assigned CVE-2021-28235 and was publicly disclosed in April 2023 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is classified as CWE-287 (Improper Authentication). The vulnerability can only be triggered when three specific conditions are met: authentication is enabled, log level is set to 'debug', and clients send authentication requests to etcdserver with username & password (GitHub PR).

The vulnerability allows remote attackers to escalate privileges, potentially gaining unauthorized access to critical system resources. Given etcd's role in storing critical data for distributed systems, particularly in Kubernetes environments, this vulnerability could have significant security implications for affected deployments (NVD).

The vulnerability has been fixed in multiple versions through a security patch that clears passwords after authentication. The fix was implemented in pull request #15648 and backported to versions 3.4 and 3.5. Users are advised to upgrade to patched versions of etcd (GitHub PR).