CVE-2026-73499High▾ Twilightetcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to recei…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
go.etcd.io/etcd/v3 >= 3.7.0-alpha.0, < 3.7.1go.etcd.io/etcd/v3 >= 3.6.0, < 3.6.14go.etcd.io/etcd/v3 < 3.5.33Patched in:
go.etcd.io/etcd/v3 3.7.1go.etcd.io/etcd/v3 3.6.14go.etcd.io/etcd/v3 3.5.33Connected by shared product, vendor, weakness, or advisory.
GHSA-xg4h-6gfc-h4m8Highetcd: Watch API authorization bypass via open-ended range requests
GHSA-6vch-q96h-7gc3Highetcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
CVE-2020-15106Medium· 5.3etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic
GHSA-5x4g-q5rc-36jpLowEtcd pkg Insecure ciphers are allowed by default
CVE-2020-15115Medium· 5.8etcd has no minimum password length
CVE-2020-15114High· 7.7Etcd Gateway can include itself as an endpoint resulting in resource exhaustion