CVE-2026-73499
published 2026-08-12CVE-2026-73499: etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a…
PriorityP346high7.1CVSS 4.0
AVNACLATNPRLUINVCHVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.66%
51.1th percentile
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| etcd-io | etcd | < 3.5.33 | 3.5.33 |
| etcd-io | etcd | — | — |
| etcd-io | etcd | — | — |
| etcd | etcd | — | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
| openshift4 | ose-etcd | — | — |
| openshift4 | ose-etcd-rhel9 | — | — |
| rhacm2 | observatorium-rhel9 | — | — |
| rhoso-operators | openstack-operator-bundle | — | — |
| rhosp-rhel8 | openstack-etcd | — | — |
CVSS provenance
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
go.etcd.io/etcd: etcd: Information disclosure via Watch API authorization bypass
vendor_redhat·2026-08-12·CVSS 7.1
CVE-2026-73499 [HIGH] CWE-551 go.etcd.io/etcd: etcd: Information disclosure via Watch API authorization bypass
go.etcd.io/etcd: etcd: Information disclosure via Watch API authorization bypass
A flaw was found in etcd, a distributed key-value store. A user with READ permission on a single key can bypass authorization checks in the Watch gRPC API by using open-ended range requests. This allows them to receive watch events for keys beyond their authorized scope, leading to information disclosure. This issue affects clusters with authentication enabled.
Statement: A flaw was found in etcd's Watch gRPC API. A user with READ permission on a single key can use open-ended range requests to bypass RBAC authorization and receive watch events for keys beyond their authorized scope, leading to information disclosure. This issue only affects etcd clusters with authentication enabled.
Mitigation: If etcd auth
VulDB
etcd-io etcd up to 3.5.32/3.6.13/3.7.0 Range Permission Cache range_perm_cache.go isRangeOpPermitted permission
vuldb·2026-08-12·CVSS 7.1
CVE-2026-73499 [HIGH] etcd-io etcd up to 3.5.32/3.6.13/3.7.0 Range Permission Cache range_perm_cache.go isRangeOpPermitted permission
A vulnerability has been found in etcd-io etcd up to 3.5.32/3.6.13/3.7.0 and classified as problematic. Affected by this vulnerability is the function isRangeOpPermitted of the file server/auth/range_perm_cache.go of the component Range Permission Cache. Performing a manipulation results in permission issues.
This vulnerability is identified as CVE-2026-73499. The attack can be initiated remotely. There is not any exploit available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41edhttps://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eaehttps://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7https://github.com/etcd-io/etcd/releases/tag/v3.5.33https://github.com/etcd-io/etcd/releases/tag/v3.6.14https://github.com/etcd-io/etcd/releases/tag/v3.7.1https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8
2026-08-12
Published