PT-2026-71355 · Etcd · Etcd
CVE-2026-73499
·
Published
2026-07-24
·
Updated
2026-09-04
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
etcd versions prior to 3.5.33
etcd versions prior to 3.6.14
etcd versions prior to 3.7.1
Description
In clusters with authentication enabled, a user with READ permission for a specific key can bypass authorization to receive watch events for all keys lexicographically greater than or equal to that key. This occurs when using the Watch gRPC API with
clientv3.WithFromKey(). The issue stems from the isRangeOpPermitted() function in server/auth/range perm cache.go, where the open-ended RangeEnd sentinel is rewritten in server/etcdserver/api/v3rpc/watch.go before the RBAC (Role-Based Access Control) permission check, leading the system to incorrectly treat the request as an exact-key watch. Range/Get and DeleteRange requests are not impacted.Recommendations
Update to version 3.5.33.
Update to version 3.6.14.
Update to version 3.7.1.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Etcd