VYPR
← All advisories
High severityNVD Advisory· Published Aug 12, 2026· Updated Sep 18, 2026

CVE-2026-73499

CVE-2026-73499

Description

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
go.etcd.io/etcd/v3Go
>= 3.7.0-alpha.0, < 3.7.13.7.1
go.etcd.io/etcd/v3Go
>= 3.6.0, < 3.6.143.6.14
go.etcd.io/etcd/v3Go
< 3.5.333.5.33

Affected products

61

Patches

Vulnerability mechanics

References

9

News mentions

0

No linked articles in our index yet.