CVE-2026-33413: etcd: Authorization bypasses in multiple APIs

What kind of vulnerability is it? Who is impacted?

Multiple vulnerabilities allow unauthorized users to bypass authentication or authorization checks and call certain etcd functions in clusters that expose the gRPC API to untrusted or partially trusted clients.

In unpatched etcd clusters with etcd auth enabled, unauthorized users are able to:

• call MemberList and learn cluster topology, including member IDs and advertised endpoints
• call Alarm, which can be abused for operational disruption or denial of service
• use Lease APIs, interfering with TTL-based keys and lease ownership
• trigger compaction, permanently removing historical revisions and disrupting watch, audit, and recovery workflows

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.