High, CVSS 7.1GoAmendedPublished
etcd: Watch API authorization bypass via open-ended range requests
CVE-2026-73499 · GHSA-xg4h-6gfc-h4m8
- Affected
- Go go.etcd.io/etcd/server/v3 < 3.5.33; >= 3.6.0, < 3.6.14; >= 3.7.0-alpha.0, < 3.7.1
- Fixed in
- 3.5.333.6.143.7.1· Vendor fix available
- Issue
- Impact What kind of vulnerability is it? Who is impacted? A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted. This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access. Patches Has the problem been patched? What versions should users upgrade to? This vulnerability is patched in the following versions: - etcd 3.7.1 - etcd 3.6.14 - etcd 3.5.33 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? If upgrading is not immediately possible, the following mitigations reduce exposure: - Audit READ…
Recommended action: Upgrade to 3.7.1, 3.6.14 or 3.5.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.