{"id":"CVE-2026-44283","title":"etcd: etcd: Authenticated user can bypass RBAC for unauthorized data access (CVE-2026-44283)","summary":"A flaw was found in etcd, a distributed key-value store. An authenticated user, without sufficient read or lease-related permissions, could bypass Role-Based Access Control (RBAC) authorization checks. This bypass occurs during transaction…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"vendor","cwe":"CWE-639","vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.2","affected":["openshift_container_platform 4","openstack_platform 16.2","openstack_platform 17.1","hardened_images"],"patched":["hardened_images"],"published":"2026-05-14","updated":"2026-09-21","sourceUpdated":"2026-09-21T11:42:25+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44283.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44283.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-44283"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477527"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44283"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44283"},{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5"},{"url":"https://access.redhat.com/errata/RHSA-2026:44868"},{"url":"https://github.com/etcd-io/etcd"}],"tags":["csaf","vex","red-hat","osv","go","score-dispute"],"epss":0.00225,"epssPercentile":0.13387,"aliases":["GHSA-x35m-3gp4-4fh5","BIT-etcd-2026-44283","GO-2026-5736"],"ecosystem":"go","scores":{"vendor":4.3,"osv":0},"ingestedAt":"2026-07-25T19:08:12.122Z","slug":"CVE-2026-44283","body":"## Overview\n\nA flaw was found in etcd, a distributed key-value store. An authenticated user, without sufficient read or lease-related permissions, could bypass Role-Based Access Control (RBAC) authorization checks. This bypass occurs during transaction operations involving PrevKv or lease attachment in Put requests, potentially leading to unauthorized data access or lease attachment.\n\n## Vendor advisories\n\n- **RHSA-2026:44868** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:44868)\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 · no fix planned: Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44283.json)\n\n**etcd: etcd: Authenticated user can bypass RBAC for unauthorized data access** — rated Moderate by Red Hat. Released 2026-05-14, updated 2026-09-21.\n\nAffected:\n\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n\nFixed:\n\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:44868\n\nWorkarounds / mitigations:\n\n- For OpenShift Container Platform until an update can be applied, reduce exposure by restricting network access to etcd server ports so only trusted control-plane components can connect and require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution; these measures limit direct access to the etcd data store but do not replace applying the security update.\n\n## Package advisory (CVE-2026-44283)\n\nAffected packages:\n\n- `go.etcd.io/etcd/v3 >= 3.6.0, < 3.6.11`\n- `go.etcd.io/etcd/v3 >= 3.5.0, < 3.5.30`\n- `go.etcd.io/etcd < 3.4.44`\n\nPatched in:\n\n- `go.etcd.io/etcd/v3 3.6.11`\n- `go.etcd.io/etcd/v3 3.5.30`\n- `go.etcd.io/etcd 3.4.44`\n\nSource: https://osv.dev/vulnerability/GHSA-x35m-3gp4-4fh5","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201655,"id":"CVE-2026-44283","ts":1789399581923,"field":"cvss","old":"0","new":"4.3"},{"seq":201654,"id":"CVE-2026-44283","ts":1789399581923,"field":"severity","old":"none","new":"medium"},{"seq":200387,"id":"CVE-2026-44283","ts":1789397207516,"field":"cvss","old":"4.3","new":"0"},{"seq":200386,"id":"CVE-2026-44283","ts":1789397207516,"field":"severity","old":"medium","new":"none"},{"seq":198311,"id":"CVE-2026-44283","ts":1789391830093,"field":"cvss","old":"0","new":"4.3"},{"seq":198310,"id":"CVE-2026-44283","ts":1789391830093,"field":"severity","old":"none","new":"medium"},{"seq":196104,"id":"CVE-2026-44283","ts":1789383477923,"field":"cvss","old":"4.3","new":"0"},{"seq":196103,"id":"CVE-2026-44283","ts":1789383477923,"field":"severity","old":"medium","new":"none"},{"seq":195033,"id":"CVE-2026-44283","ts":1789380355796,"field":"cvss","old":"0","new":"4.3"},{"seq":195032,"id":"CVE-2026-44283","ts":1789380355796,"field":"severity","old":"none","new":"medium"},{"seq":193820,"id":"CVE-2026-44283","ts":1789378325363,"field":"cvss","old":"4.3","new":"0"},{"seq":193819,"id":"CVE-2026-44283","ts":1789378325363,"field":"severity","old":"medium","new":"none"},{"seq":192607,"id":"CVE-2026-44283","ts":1789376303056,"field":"cvss","old":"0","new":"4.3"},{"seq":192606,"id":"CVE-2026-44283","ts":1789376303056,"field":"severity","old":"none","new":"medium"},{"seq":191394,"id":"CVE-2026-44283","ts":1789373238354,"field":"cvss","old":"4.3","new":"0"},{"seq":191393,"id":"CVE-2026-44283","ts":1789373238354,"field":"severity","old":"medium","new":"none"},{"seq":190179,"id":"CVE-2026-44283","ts":1789369195207,"field":"cvss","old":"0","new":"4.3"},{"seq":190178,"id":"CVE-2026-44283","ts":1789369195207,"field":"severity","old":"none","new":"medium"},{"seq":188966,"id":"CVE-2026-44283","ts":1789368098187,"field":"cvss","old":"4.3","new":"0"},{"seq":188965,"id":"CVE-2026-44283","ts":1789368098187,"field":"severity","old":"medium","new":"none"},{"seq":187749,"id":"CVE-2026-44283","ts":1789365052223,"field":"cvss","old":"0","new":"4.3"},{"seq":187748,"id":"CVE-2026-44283","ts":1789365052223,"field":"severity","old":"none","new":"medium"},{"seq":186536,"id":"CVE-2026-44283","ts":1789363090659,"field":"cvss","old":"4.3","new":"0"},{"seq":186535,"id":"CVE-2026-44283","ts":1789363090659,"field":"severity","old":"medium","new":"none"},{"seq":185322,"id":"CVE-2026-44283","ts":1789361010878,"field":"cvss","old":"0","new":"4.3"},{"seq":185321,"id":"CVE-2026-44283","ts":1789361010878,"field":"severity","old":"none","new":"medium"},{"seq":184109,"id":"CVE-2026-44283","ts":1789358002134,"field":"cvss","old":"4.3","new":"0"},{"seq":184108,"id":"CVE-2026-44283","ts":1789358002134,"field":"severity","old":"medium","new":"none"},{"seq":182360,"id":"CVE-2026-44283","ts":1789354153138,"field":"cvss","old":"0","new":"4.3"},{"seq":182359,"id":"CVE-2026-44283","ts":1789354153138,"field":"severity","old":"none","new":"medium"},{"seq":181153,"id":"CVE-2026-44283","ts":1789352995917,"field":"cvss","old":"4.3","new":"0"},{"seq":181152,"id":"CVE-2026-44283","ts":1789352995917,"field":"severity","old":"medium","new":"none"},{"seq":179946,"id":"CVE-2026-44283","ts":1789350064047,"field":"cvss","old":"0","new":"4.3"},{"seq":179945,"id":"CVE-2026-44283","ts":1789350064047,"field":"severity","old":"none","new":"medium"},{"seq":178739,"id":"CVE-2026-44283","ts":1789347930987,"field":"cvss","old":"4.3","new":"0"},{"seq":178738,"id":"CVE-2026-44283","ts":1789347930987,"field":"severity","old":"medium","new":"none"},{"seq":177532,"id":"CVE-2026-44283","ts":1789346216546,"field":"cvss","old":"0","new":"4.3"},{"seq":177531,"id":"CVE-2026-44283","ts":1789346216546,"field":"severity","old":"none","new":"medium"},{"seq":176325,"id":"CVE-2026-44283","ts":1789342835935,"field":"cvss","old":"4.3","new":"0"},{"seq":176324,"id":"CVE-2026-44283","ts":1789342835935,"field":"severity","old":"medium","new":"none"},{"seq":175779,"id":"CVE-2026-44283","ts":1789338620177,"field":"cvss","old":"0","new":"4.3"},{"seq":175778,"id":"CVE-2026-44283","ts":1789338620177,"field":"severity","old":"none","new":"medium"},{"seq":175649,"id":"CVE-2026-44283","ts":1789338461879,"field":"cvss","old":"4.3","new":"0"},{"seq":175648,"id":"CVE-2026-44283","ts":1789338461879,"field":"severity","old":"medium","new":"none"},{"seq":174444,"id":"CVE-2026-44283","ts":1789334640457,"field":"cvss","old":"0","new":"4.3"},{"seq":174443,"id":"CVE-2026-44283","ts":1789334640457,"field":"severity","old":"none","new":"medium"},{"seq":173239,"id":"CVE-2026-44283","ts":1789333303040,"field":"cvss","old":"4.3","new":"0"},{"seq":173238,"id":"CVE-2026-44283","ts":1789333303040,"field":"severity","old":"medium","new":"none"},{"seq":172053,"id":"CVE-2026-44283","ts":1789330938298,"field":"cvss","old":"0","new":"4.3"},{"seq":172052,"id":"CVE-2026-44283","ts":1789330938298,"field":"severity","old":"none","new":"medium"}]}