Key-level Authorization Bypass Vulnerability in etcd by etcd-io
CVE-2026-33343
NONE
What is CVE-2026-33343?
A vulnerability has been identified in etcd, a distributed key-value store, where authenticated users with RBAC-restricted permissions can exploit nested transactions to bypass key-level authorization controls. This flaw enables unauthorized access to the entire etcd data store, threatening the integrity and confidentiality of sensitive data. It primarily affects versions prior to 3.4.42, 3.5.28, and 3.6.9. To mitigate risks, users are advised to restrict network access to etcd server ports and implement strong client identity verification, such as using mTLS with strict client certificate distribution.
Affected Version(s)
etcd >= 3.5.0-alpha.0, < 3.5.28 < 3.5.0-alpha.0, 3.5.28
etcd >= 3.6.0-alpha.0, < 3.6.9 < 3.6.0-alpha.0, 3.6.9
etcd < 3.4.42 < 3.4.42