etcd

etcd is a distributed key-value store that serves as the backbone of Kubernetes clusters and other distributed systems for configuration management and service discovery. The client API listens on TCP port 2379 and peer communication runs on TCP port 2380. Nmap typically identifies port 2379 as http.

In Kubernetes environments, etcd stores the entire cluster state, including secrets, service account tokens, ConfigMaps, and pod specifications. Unauthenticated access to etcd means full control over the cluster. Even outside Kubernetes, etcd often holds sensitive application configuration and credentials. By default, etcd does not require authentication, and many deployments skip client certificate verification.

Enumeration starts with querying the version endpoint at /version and health at /health. The v2 API (/v2/keys/?recursive=true) and v3 API (via etcdctl) allow listing and reading all stored keys. In Kubernetes clusters, dumping etcd reveals Secrets (base64-encoded by default, not encrypted), service account tokens for privilege escalation, and the full cluster topology. Checking for write access allows modifying cluster state directly.