GHSA-xg4h-6gfc-h4m8: etcd: Watch API authorization bypass via open-ended range requests
(updated )
What kind of vulnerability is it? Who is impacted?
A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, “from this key to the end of the keyspace” watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.
This is an authorization bypass in etcd’s RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.
References
- github.com/advisories/GHSA-xg4h-6gfc-h4m8
- github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
- github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae
- github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7
- github.com/etcd-io/etcd/releases/tag/v3.5.33
- github.com/etcd-io/etcd/releases/tag/v3.6.14
- github.com/etcd-io/etcd/releases/tag/v3.7.1
- github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8
- nvd.nist.gov/vuln/detail/CVE-2026-73499
Code Behaviors & Features
Detect and mitigate GHSA-xg4h-6gfc-h4m8 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →