CVE-2026-73499: CWE-863: Incorrect Authorization in etcd-io etcd
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
AI Analysis
Technical Summary
The vulnerability in etcd (CVE-2026-73499) arises from incorrect authorization in the Watch gRPC API. When a user has READ permission on a single exact key, they can use the clientv3.WithFromKey() option to watch events for all keys lexicographically greater than or equal to that key. This is due to the open-ended RangeEnd sentinel being rewritten before the RBAC permission check in the function isRangeOpPermitted, causing the request to be treated as an exact-key watch incorrectly. This flaw does not affect Range/Get or DeleteRange requests and only impacts clusters with authentication enabled. The issue is resolved in versions 3.5.33, 3.6.14, and 3.7.1.
Potential Impact
An attacker with READ permission on a single exact key can bypass intended access restrictions to observe watch events for a broader set of keys, potentially exposing more data than authorized. This could lead to unauthorized data exposure within the etcd cluster. The vulnerability does not allow modification or deletion of data and only affects watch event visibility. It only impacts clusters where authentication is enabled.
Mitigation Recommendations
This vulnerability is fixed in etcd versions 3.5.33, 3.6.14, and 3.7.1. Users should upgrade to these or later versions to remediate the issue. No other mitigation or temporary workaround is indicated. Since this is not a cloud service, remediation depends on user action to upgrade.
CVE-2026-73499: CWE-863: Incorrect Authorization in etcd-io etcd
Description
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
CVSS v4.0
Score 7.1high
Affected software
etcd-io
etcd
pkg:github/etcd-io/etcdRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in etcd (CVE-2026-73499) arises from incorrect authorization in the Watch gRPC API. When a user has READ permission on a single exact key, they can use the clientv3.WithFromKey() option to watch events for all keys lexicographically greater than or equal to that key. This is due to the open-ended RangeEnd sentinel being rewritten before the RBAC permission check in the function isRangeOpPermitted, causing the request to be treated as an exact-key watch incorrectly. This flaw does not affect Range/Get or DeleteRange requests and only impacts clusters with authentication enabled. The issue is resolved in versions 3.5.33, 3.6.14, and 3.7.1.
Potential Impact
An attacker with READ permission on a single exact key can bypass intended access restrictions to observe watch events for a broader set of keys, potentially exposing more data than authorized. This could lead to unauthorized data exposure within the etcd cluster. The vulnerability does not allow modification or deletion of data and only affects watch event visibility. It only impacts clusters where authentication is enabled.
Mitigation Recommendations
This vulnerability is fixed in etcd versions 3.5.33, 3.6.14, and 3.7.1. Users should upgrade to these or later versions to remediate the issue. No other mitigation or temporary workaround is indicated. Since this is not a cloud service, remediation depends on user action to upgrade.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-12T19:00:33.736Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7ce89cbf8831d5393450e5
Added to database: 08/12/2026, 21:41:48 UTC
Last enriched: 08/12/2026, 22:26:32 UTC
Last updated: 09/25/2026, 08:30:24 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.