Threats Tagged 'ghsa-xg4h-6gfc-h4m8'

A vulnerability in etcd's Watch API allows a user with READ permission on a single exact key to bypass authorization and watch events for all keys lexicographically greater than or equal to that key. This affects versions prior to 3.5.33, 3.6.14, and 3.7.1 when authentication is enabled. The issue arises because the open-ended RangeEnd sentinel is rewritten before the RBAC permission check, causing improper permission validation. This flaw does not affect Range/Get or DeleteRange requests and only impacts clusters with authentication enabled. The vulnerability has been fixed in the specified versions.