---
id: CVE-2026-44283
title: >-
  etcd: etcd: Authenticated user can bypass RBAC for unauthorized data access
  (CVE-2026-44283)
summary: >-
  A flaw was found in etcd, a distributed key-value store. An authenticated
  user, without sufficient read or lease-related permissions, could bypass
  Role-Based Access Control (RBAC) authorization checks. This bypass occurs
  during transaction…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: vendor
cwe: CWE-639
vendor: Red Hat
product: Red Hat OpenStack Platform 16.2
affected:
  - openshift_container_platform 4
  - openstack_platform 16.2
  - openstack_platform 17.1
  - hardened_images
patched:
  - hardened_images
published: '2026-05-14'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T11:42:25+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44283.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44283.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-44283'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2477527'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-44283'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44283'
  - url: 'https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5'
  - url: 'https://access.redhat.com/errata/RHSA-2026:44868'
  - url: 'https://github.com/etcd-io/etcd'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
  - score-dispute
epss: 0.00274
epssPercentile: 0.17694
aliases:
  - GHSA-x35m-3gp4-4fh5
  - BIT-etcd-2026-44283
  - GO-2026-5736
ecosystem: go
scores:
  vendor: 4.3
  osv: 0
ingestedAt: '2026-07-25T19:08:12.122Z'
---

## Overview

A flaw was found in etcd, a distributed key-value store. An authenticated user, without sufficient read or lease-related permissions, could bypass Role-Based Access Control (RBAC) authorization checks. This bypass occurs during transaction operations involving PrevKv or lease attachment in Put requests, potentially leading to unauthorized data access or lease attachment.

## Vendor advisories

- **RHSA-2026:44868** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:44868)
- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 · no fix planned: Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44283.json)

**etcd: etcd: Authenticated user can bypass RBAC for unauthorized data access** — rated Moderate by Red Hat. Released 2026-05-14, updated 2026-09-21.

Affected:

- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1

Fixed:

- Red Hat Hardened Images

No fix planned:

- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenShift Container Platform 4

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:44868

Workarounds / mitigations:

- For OpenShift Container Platform until an update can be applied, reduce exposure by restricting network access to etcd server ports so only trusted control-plane components can connect and require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution; these measures limit direct access to the etcd data store but do not replace applying the security update.

## Package advisory (CVE-2026-44283)

Affected packages:

- `go.etcd.io/etcd/v3 >= 3.6.0, < 3.6.11`
- `go.etcd.io/etcd/v3 >= 3.5.0, < 3.5.30`
- `go.etcd.io/etcd < 3.4.44`

Patched in:

- `go.etcd.io/etcd/v3 3.6.11`
- `go.etcd.io/etcd/v3 3.5.30`
- `go.etcd.io/etcd 3.4.44`

Source: https://osv.dev/vulnerability/GHSA-x35m-3gp4-4fh5