CVE-2026-73499

Received Received - Intake

etcd Authorization Bypass via Watch API Misconfiguration

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73499

Affected Vendors & Products

Vendor	Product	Version / Range
etcd	etcd	3.5.33
etcd	etcd	3.6.14
etcd	etcd	3.7.1
etcd	etcd	to 3.5.33 (exc)
etcd	etcd	to 3.6.14 (exc)
etcd	etcd	to 3.7.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in etcd, a distributed key-value store, allows a user with READ permission on a single key to access watch events for all keys lexicographically greater than or equal to that key using the Watch gRPC API with clientv3.WithFromKey(). The issue occurs because the open-ended RangeEnd sentinel is rewritten before the RBAC permission check, causing the request to be treated as an exact-key watch. This flaw only affects clusters with authentication enabled and is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

Detection Guidance

To detect this vulnerability, check your etcd version against the fixed versions (3.5.33, 3.6.14, 3.7.1). Run 'etcd --version' to verify. If using an affected version with authentication enabled, monitor for unauthorized watch events on keys beyond granted permissions.

Impact Analysis

If you use etcd with authentication enabled, an attacker with READ access to a single key could potentially access sensitive data from other keys they are not authorized to view. This could lead to unauthorized information disclosure, data leaks, or further exploitation of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR (General Data Protection Regulation) and HIPAA (Health Insurance Portability and Accountability Act). It may result in data breaches, unauthorized disclosures, and failure to meet strict access control and confidentiality standards.

Mitigation Strategies

Upgrade etcd to versions 3.5.33, 3.6.14, or 3.7.1 or later to fix the issue. Ensure authentication is enabled and restrict READ permissions to only necessary keys to limit exposure.

Hi! I’m here to help you understand CVE-2026-73499. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70