Watch API authorization bypass in go.etcd.io/etcd/server/v3
In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey(). The Watch RPC handler normalized open-ended range ends prior to authorization checks, causing isWatchPermitted to evaluate the request as a single-key watch while the underlying watch stream received events for all keys lexicographically greater than or equal to the target key.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-73499US | —OT erhöht | — | ||
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can us… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41FIX
- https://github.com/etcd-io/etcd/releases/tag/v3.5.33WEB
- https://github.com/etcd-io/etcd/releases/tag/v3.6.14WEB
- https://github.com/etcd-io/etcd/releases/tag/v3.7.1WEB
- https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan