Access Control Flaw in etcd Affects Key-Value Store Functionality
CVE-2026-73499
What is CVE-2026-73499?
etcd, a widely used distributed key-value store, contains a significant access control vulnerability. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user with READ permission on a specific key can leverage the Watch gRPC API with clientv3.WithFromKey() to unlawfully receive watch events for all keys that are lexicographically greater than or equal to the allowed key. This occurs because the open-ended RangeEnd sentinel is incorrectly rewritten before the RBAC permission verification. It is important to note that the range operations, such as Range/Get and DeleteRange, remain unaffected by this issue. Clusters with authentication enabled are particularly at risk. Immediate updates to the recommended versions are highly advised to mitigate this security risk.
Affected Version(s)
etcd < 3.5.33 < 3.5.33
etcd >= 3.6.0, < 3.6.14 < 3.6.0, 3.6.14
etcd >= 3.7.0-alpha.0, < 3.7.1 < 3.7.0-alpha.0, 3.7.1