CVE-2026-73499
etcd: Watch API authorization bypass via open-ended range requests
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Timeline
ID reserved
By GitHub_M
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 4.0 | High7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| NVDNVD · Awaiting Analysis | 4.0 | High7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.66% · top 48% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogo.etcd.io/etcd/v3GHSA-xg4h-6gfc-h4m8 (opens in a new tab)
References (8)
- https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8 (opens in a new tab)x_refsource_CONFIRM
- https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41 (opens in a new tab)x_refsource_MISC
- https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed (opens in a new tab)x_refsource_MISC
- https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae (opens in a new tab)x_refsource_MISC
- https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7 (opens in a new tab)x_refsource_MISC
- https://github.com/etcd-io/etcd/releases/tag/v3.5.33 (opens in a new tab)x_refsource_MISC
- https://github.com/etcd-io/etcd/releases/tag/v3.6.14 (opens in a new tab)x_refsource_MISC
- https://github.com/etcd-io/etcd/releases/tag/v3.7.1 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-xg4h-6gfc-h4m8 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-73499)Record last updated .