EUVD-2026-57641
GHSA-xg4h-6gfc-h4m8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity flaw requiring authenticated access (PR:L); read-only watch bypass yields full keyspace confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
AnalysisAI
Watch API authorization bypass in etcd allows any authenticated low-privilege user to silently read the entire keyspace beyond their granted key. A user holding a READ grant on a single exact key can invoke the Watch gRPC API with clientv3.WithFromKey() to receive streaming events for every key lexicographically greater than or equal to their permitted key - an unbounded confidentiality breach against etcd's RBAC model. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concrete conditions must hold simultaneously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scoring 7.1 is an accurate representation of the threat: network-reachable, low-complexity exploitation by any authenticated low-privilege user yields high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid etcd account granted READ on a single low-sort-order key such as /app/config/version uses the standard etcd Go client to open a Watch stream with clientv3.WithFromKey() targeting that key. The server's pre-check rewrite causes RBAC to approve the request as a single-key watch; the stream then delivers all keyspace mutation events for every key at or beyond /app/config/version - including Kubernetes secrets, service account tokens, and application credentials. … |
| Remediation | Upgrade to etcd 3.5.33, 3.6.14, or 3.7.1 depending on the deployed branch; release artifacts are available at https://github.com/etcd-io/etcd/releases/tag/v3.5.33, https://github.com/etcd-io/etcd/releases/tag/v3.6.14, and https://github.com/etcd-io/etcd/releases/tag/v3.7.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all etcd deployments to determine current versions and identify systems running vulnerable releases (etcd prior to 3.5.33, 3.6.0-3.6.13, or 3.7 pre-releases), prioritizing production clusters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. Rated high severity (CVSS 8.8), this vulnerabilit
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug func
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. Rated medium severity (CVSS 5.5), this vulnerability is low
Memory exhaustion in etcd's TLS acceptor loop allows unauthenticated network attackers to crash etcd clusters - and the
Certificate revocation bypass in etcd affects clusters running versions before 3.5.32 and before 3.6.13 that are configu
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery a
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short pass
In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory pa
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV r
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in t
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. Rated medium severity (CVS
etcd is a distributed key-value store for the data of a distributed system. Rated medium severity (CVSS 4.3), this vulne
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today