In etcd versions before 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on an exact key can exploit the Watch gRPC API with clientv3.WithFromKey() to receive watch events for all keys lexicographically greater than or equal to the permitted key. The root cause is that the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in the function isRangeOpPermitted, leading to the request being treated as an exact-key watch rather than a range watch. This results in an authorization bypass for the Watch API. Range/Get and DeleteRange requests remain unaffected. The vulnerability requires authentication to be enabled on the cluster and has been addressed in the fixed versions.

An attacker with READ permission on a single exact key can bypass intended authorization restrictions and observe watch events for a broader set of keys, potentially exposing more data than permitted. This could lead to unauthorized data disclosure within the etcd key-value store. The impact is limited to clusters with authentication enabled and does not affect other request types like Range/Get or DeleteRange.

Upgrade etcd to version 3.5.33, 3.6.14, or 3.7.1 or later, where this authorization bypass issue is fixed. Since a patch is available, applying the official fix is the recommended remediation. No other mitigations are indicated or necessary for this specific vulnerability.