CVE-2026-73499: etcd Auth Bypass Vulnerability

CVE-2026-73499 Overview

CVE-2026-73499 is an authorization bypass vulnerability [CWE-863] in etcd, a distributed key-value store widely used by Kubernetes and other distributed systems. A user granted READ permission on a single exact key can abuse the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. The flaw exists in the interaction between server/etcdserver/api/v3rpc/watch.go and the RBAC check in server/auth/range_perm_cache.go. The issue affects only clusters with authentication enabled and is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

Critical Impact
A low-privileged authenticated user with read access to a single key can silently exfiltrate updates for large portions of the keyspace, exposing secrets, configuration, and application state stored in etcd.

Affected Products

etcd versions prior to 3.5.33 in the 3.5.x branch
etcd versions prior to 3.6.14 in the 3.6.x branch
etcd versions prior to 3.7.1 in the 3.7.x branch

Discovery Timeline

2026-08-12 - CVE-2026-73499 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73499

Vulnerability Analysis

The vulnerability is a broken access control flaw in etcd's Watch gRPC API. etcd supports both exact-key watches and range watches, where RangeEnd defines the upper bound of the range. The clientv3.WithFromKey() client option requests a watch over every key lexicographically greater than or equal to the provided key, which is encoded as an open-ended RangeEnd sentinel.

In the vulnerable code path within server/etcdserver/api/v3rpc/watch.go, the server rewrote the open-ended RangeEnd sentinel value before invoking the RBAC permission check. The subsequent authorization call in isRangeOpPermitted (in server/auth/range_perm_cache.go) therefore evaluated the request as an exact-key watch instead of a range watch. This mismatch allowed a request for the entire keyspace to pass a check that only validated access to one key.

Range, Get, and DeleteRange operations follow a different code path and are not affected. The issue applies only when authentication is enabled, since RBAC is otherwise not enforced.

Root Cause

The root cause is an ordering error between input normalization and authorization. The server converted the RangeEnd sentinel that represents "from this key onward" into its expanded form before RBAC evaluated the requested key range. As a result, the permission check never observed the true scope of the watch request.

Attack Vector

An attacker requires valid credentials and READ permission on at least one key in the target etcd cluster. Using any etcd v3 client, the attacker opens a Watch request against that key with the WithFromKey() option. The server accepts the watch and begins streaming events for every key sorted at or after the permitted key, providing continuous read access to unauthorized data as it changes.

// Patch excerpt from server/etcdserver/api/v3rpc/watch.go
// Removed pre-authorization rewrites of RangeEnd that caused the
// open-ended ">= key" sentinel to be treated as an exact-key watch.

				// \\x00 is the smallest key
				creq.Key = []byte{0}
			}
-			if len(creq.RangeEnd) == 0 {
-				// force nil since watchstream.Watch distinguishes
-				// between nil and []byte{} for single key / >=
-				creq.RangeEnd = nil
-			}
-			if len(creq.RangeEnd) == 1 && creq.RangeEnd[0] == 0 {
-				// support  >= key queries
-				creq.RangeEnd = []byte{}
-			}
			if creq.StartRevision < 0 {
				wr := &pb.WatchResponse{
					Header:       sws.newResponseHeader(sws.watchStream.Rev()),

Source: GitHub Commit 6643f80

Detection Methods for CVE-2026-73499

Indicators of Compromise

Watch gRPC requests from authenticated identities that specify a RangeEnd value inconsistent with the identity's granted key permissions.
Unexpected long-lived watch streams from service accounts that should only observe a single key.
etcd audit or gRPC access logs showing WithFromKey()-style watch requests originating from low-privileged users.

Detection Strategies

Enable etcd request logging and inspect WatchCreateRequest entries for range_end fields that exceed the caller's RBAC scope.
Correlate authenticated identities in etcd with their RBAC role bindings and alert when a watch's key range does not match the granted keys.
Compare etcd server version banners against fixed releases 3.5.33, 3.6.14, and 3.7.1 to identify exposed clusters.

Monitoring Recommendations

Forward etcd audit and gRPC logs into a centralized analytics platform for continuous RBAC anomaly detection.
Alert on new watch streams established by non-administrative users immediately after credential issuance or rotation.
Track Kubernetes control-plane etcd traffic for watch clients that are not kube-apiserver, since third-party watchers using WithFromKey() warrant review.

How to Mitigate CVE-2026-73499

Immediate Actions Required

Upgrade etcd to version 3.5.33, 3.6.14, or 3.7.1 as appropriate for your deployment branch.
Rotate any secrets, tokens, or configuration values that were stored in etcd and may have been exposed to low-privileged authenticated users.
Audit existing RBAC role grants and remove unused or overly broad READ permissions on individual keys.

Patch Information

The etcd maintainers published fixes in GitHub Release v3.5.33, GitHub Release v3.6.14, and GitHub Release v3.7.1. Technical details are documented in GitHub Security Advisory GHSA-xg4h-6gfc-h4m8. The patch removes the pre-authorization rewrite of the open-ended RangeEnd sentinel so that isRangeOpPermitted evaluates the true requested range.

Workarounds

Restrict etcd client network access to trusted control-plane components using firewall rules or mTLS peer authentication.
Review and tighten RBAC role bindings so that non-administrative users are not granted READ on sensitive keys until the cluster is patched.
If a rolling upgrade is not immediately possible, revoke unused user accounts with any READ grants to reduce exposure.

bash

# Verify the running etcd server version against the fixed releases
etcdctl version

# Example: list existing user role bindings to audit RBAC scope
etcdctl --user root:<password> user list
etcdctl --user root:<password> role get <role-name>