The vulnerability is an authorization bypass in etcd's RBAC enforcement for the Watch API. Specifically, a user granted READ permission on a single exact key can exploit the Watch API's open-ended range watch (clientv3.WithFromKey()) to observe watch events for all keys lexicographically greater than or equal to their permitted key. This bypass allows broader read access than intended. The vulnerability only affects clusters with authentication enabled; unauthenticated clusters already allow unrestricted read access. Range/Get and DeleteRange requests are not affected. The issue is fixed in etcd versions 3.7.1, 3.6.14, and 3.5.33.

Users with limited READ permission on a single key can bypass authorization controls to watch and receive events for a larger key range, potentially exposing sensitive data beyond their granted scope. This compromises the integrity of access control in etcd clusters with authentication enabled. The vulnerability does not affect other API methods such as Range/Get or DeleteRange.

A fix is available in etcd versions 3.7.1, 3.6.14, and 3.5.33; users should upgrade to these or later versions to remediate the vulnerability. If immediate upgrade is not possible, audit and tighten READ permissions to ensure only trusted users have such grants, as any READ grant can be leveraged to read beyond the intended key. Additionally, restrict network access to the etcd client (gRPC) port using firewall rules or network policies to limit potential exploitation.