{"schema_version":"1.9.0","id":"CVE-2026-44283","published":"2026-05-14T17:01:33.598Z","modified":"2026-08-27T18:26:15.113771909Z","aliases":["BIT-etcd-2026-44283","GHSA-x35m-3gp4-4fh5","GO-2026-5736"],"related":["CGA-wjgx-pjrx-8cjv","SUSE-SU-2026:23216-1","SUSE-SU-2026:23227-1","openSUSE-SU-2026:10980-1","openSUSE-SU-2026:21551-1"],"summary":"etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks","details":"etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/etcd-io/etcd","events":[{"introduced":"0"},{"fixed":"59098950c8e467cdf3cf234b56b57449fec1a507"},{"introduced":"946a5a6f25c3b6b89408ab447852731bde6e6289"},{"fixed":"7d20602453b3a5ad9eda401510ea53522c611ee3"},{"introduced":"f5d605a93abe2fdfa13880aab0f1f3a4203628dd"},{"fixed":"ec166e2292a58365c90e96fcd206b3b74938d49d"}],"database_specific":{"cpe":"cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.4.44"},{"introduced":"3.5.0"},{"fixed":"3.5.30"},{"introduced":"3.6.0"},{"fixed":"3.6.11"}],"source":"CPE_RANGE"}}],"versions":["v3.4.43","v3.5.29","tests/v3.5.29","server/v3.5.29","raft/v3.5.29","pkg/v3.5.29","etcdutl/v3.5.29","etcdctl/v3.5.29","client/v3.5.29","client/v2.305.29","client/pkg/v3.5.29","api/v3.5.29","v3.6.10","tests/v3.6.10","server/v3.6.10","pkg/v3.6.10","etcdutl/v3.6.10","etcdctl/v3.6.10","client/v3.6.10","client/pkg/v3.6.10","api/v3.6.10","v3.4.42","v3.5.28","tests/v3.5.28","server/v3.5.28","raft/v3.5.28","pkg/v3.5.28","etcdutl/v3.5.28","etcdctl/v3.5.28","client/v3.5.28","client/v2.305.28","client/pkg/v3.5.28","api/v3.5.28","v3.6.9","tests/v3.6.9","server/v3.6.9","pkg/v3.6.9","etcdutl/v3.6.9","etcdctl/v3.6.9","client/v3.6.9","client/pkg/v3.6.9","api/v3.6.9","v3.4.41","v3.5.27","tests/v3.5.27","server/v3.5.27","raft/v3.5.27","pkg/v3.5.27","etcdutl/v3.5.27","etcdctl/v3.5.27","client/v3.5.27","client/v2.305.27","client/pkg/v3.5.27","api/v3.5.27","v3.6.8","tests/v3.6.8","server/v3.6.8","pkg/v3.6.8","etcdutl/v3.6.8","etcdctl/v3.6.8","client/v3.6.8","client/pkg/v3.6.8","api/v3.6.8","v3.4.40","v3.5.26","tests/v3.5.26","server/v3.5.26","raft/v3.5.26","pkg/v3.5.26","etcdutl/v3.5.26","etcdctl/v3.5.26","client/v3.5.26","client/v2.305.26","client/pkg/v3.5.26","api/v3.5.26","v3.6.7","tests/v3.6.7","server/v3.6.7","pkg/v3.6.7","etcdutl/v3.6.7","etcdctl/v3.6.7","client/v3.6.7","client/pkg/v3.6.7","api/v3.6.7","v3.4.39","v3.5.25","tests/v3.5.25","server/v3.5.25","raft/v3.5.25","pkg/v3.5.25","etcdutl/v3.5.25","etcdctl/v3.5.25","client/v3.5.25","client/v2.305.25","client/pkg/v3.5.25","api/v3.5.25","v3.6.6","tests/v3.6.6","server/v3.6.6","pkg/v3.6.6","etcdutl/v3.6.6","etcdctl/v3.6.6","client/v3.6.6","client/pkg/v3.6.6","api/v3.6.6","v3.5.24","tests/v3.5.24","server/v3.5.24","raft/v3.5.24","pkg/v3.5.24","etcdutl/v3.5.24","etcdctl/v3.5.24","client/v3.5.24","client/v2.305.24","client/pkg/v3.5.24","api/v3.5.24","v3.4.38","v3.5.23","tests/v3.5.23","server/v3.5.23","raft/v3.5.23","pkg/v3.5.23","etcdutl/v3.5.23","etcdctl/v3.5.23","client/v3.5.23","client/v2.305.23","client/pkg/v3.5.23","api/v3.5.23","v3.6.5","tests/v3.6.5","server/v3.6.5","pkg/v3.6.5","etcdutl/v3.6.5","etcdctl/v3.6.5","client/v3.6.5","client/pkg/v3.6.5","api/v3.6.5","v3.5.22","tests/v3.5.22","server/v3.5.22","raft/v3.5.22","pkg/v3.5.22","etcdutl/v3.5.22","etcdctl/v3.5.22","client/v3.5.22","client/v2.305.22","client/pkg/v3.5.22","api/v3.5.22","v3.6.4","tests/v3.6.4","server/v3.6.4","pkg/v3.6.4","etcdutl/v3.6.4","etcdctl/v3.6.4","client/v3.6.4","client/pkg/v3.6.4","api/v3.6.4","v3.6.3","tests/v3.6.3","server/v3.6.3","pkg/v3.6.3","etcdutl/v3.6.3","etcdctl/v3.6.3","client/v3.6.3","client/pkg/v3.6.3","api/v3.6.3","v3.6.2","tests/v3.6.2","server/v3.6.2","pkg/v3.6.2","etcdutl/v3.6.2","etcdctl/v3.6.2","client/v3.6.2","client/pkg/v3.6.2","api/v3.6.2","v3.6.1","tests/v3.6.1","server/v3.6.1","pkg/v3.6.1","etcdutl/v3.6.1","etcdctl/v3.6.1","client/v3.6.1","client/pkg/v3.6.1","api/v3.6.1","v3.6.0","tests/v3.6.0","server/v3.6.0","pkg/v3.6.0","etcdutl/v3.6.0","etcdctl/v3.6.0","client/v3.6.0","client/pkg/v3.6.0","api/v3.6.0","v3.4.37","v3.5.21","tests/v3.5.21","server/v3.5.21","raft/v3.5.21","pkg/v3.5.21","etcdutl/v3.5.21","etcdctl/v3.5.21","client/v3.5.21","client/v2.305.21","client/pkg/v3.5.21","api/v3.5.21","v3.5.20","tests/v3.5.20","server/v3.5.20","raft/v3.5.20","pkg/v3.5.20","etcdutl/v3.5.20","etcdctl/v3.5.20","client/v3.5.20","client/v2.305.20","client/pkg/v3.5.20","api/v3.5.20","v3.5.19","tests/v3.5.19","server/v3.5.19","raft/v3.5.19","pkg/v3.5.19","etcdutl/v3.5.19","etcdctl/v3.5.19","client/v3.5.19","client/v2.305.19","client/pkg/v3.5.19","api/v3.5.19","v3.4.36","v3.5.18","tests/v3.5.18","server/v3.5.18","raft/v3.5.18","pkg/v3.5.18","etcdutl/v3.5.18","etcdctl/v3.5.18","client/v3.5.18","client/v2.305.18","client/pkg/v3.5.18","api/v3.5.18","v3.5.17","tests/v3.5.17","server/v3.5.17","raft/v3.5.17","pkg/v3.5.17","etcdutl/v3.5.17","etcdctl/v3.5.17","client/v3.5.17","client/v2.305.17","client/pkg/v3.5.17","api/v3.5.17","v3.4.35","v3.4.34","v3.5.16","tests/v3.5.16","server/v3.5.16","raft/v3.5.16","pkg/v3.5.16","etcdutl/v3.5.16","etcdctl/v3.5.16","client/v3.5.16","client/v2.305.16","client/pkg/v3.5.16","api/v3.5.16","v3.5.15","tests/v3.5.15","server/v3.5.15","raft/v3.5.15","pkg/v3.5.15","etcdutl/v3.5.15","etcdctl/v3.5.15","client/v3.5.15","client/v2.305.15","client/pkg/v3.5.15","api/v3.5.15","v3.5.14","tests/v3.5.14","server/v3.5.14","raft/v3.5.14","pkg/v3.5.14","etcdutl/v3.5.14","etcdctl/v3.5.14","client/v3.5.14","client/v2.305.14","client/pkg/v3.5.14","api/v3.5.14","v3.4.33","v3.4.32","v3.5.13","tests/v3.5.13","server/v3.5.13","raft/v3.5.13","pkg/v3.5.13","etcdutl/v3.5.13","etcdctl/v3.5.13","client/v3.5.13","client/v2.305.13","client/pkg/v3.5.13","api/v3.5.13","v3.4.31","v3.4.30","v3.5.12","tests/v3.5.12","server/v3.5.12","raft/v3.5.12","pkg/v3.5.12","etcdutl/v3.5.12","etcdctl/v3.5.12","client/v3.5.12","client/v2.305.12","client/pkg/v3.5.12","api/v3.5.12","v3.4.29","v3.5.11","tests/v3.5.11","server/v3.5.11","raft/v3.5.11","pkg/v3.5.11","etcdutl/v3.5.11","etcdctl/v3.5.11","client/v3.5.11","client/v2.305.11","client/pkg/v3.5.11","api/v3.5.11","v3.4.28","v3.5.10","tests/v3.5.10","server/v3.5.10","raft/v3.5.10","pkg/v3.5.10","etcdutl/v3.5.10","etcdctl/v3.5.10","client/v3.5.10","client/v2.305.10","client/pkg/v3.5.10","api/v3.5.10","v3.4.27","v3.4.26","v3.5.9","tests/v3.5.9","server/v3.5.9","raft/v3.5.9","pkg/v3.5.9","etcdutl/v3.5.9","etcdctl/v3.5.9","client/v3.5.9","client/v2.305.9","client/pkg/v3.5.9","api/v3.5.9","v3.4.25","v3.5.8","tests/v3.5.8","server/v3.5.8","raft/v3.5.8","pkg/v3.5.8","etcdutl/v3.5.8","etcdctl/v3.5.8","client/v3.5.8","client/v2.305.8","client/pkg/v3.5.8","api/v3.5.8","v3.4.24","v3.5.7","tests/v3.5.7","server/v3.5.7","raft/v3.5.7","pkg/v3.5.7","etcdutl/v3.5.7","etcdctl/v3.5.7","client/v3.5.7","client/v2.305.7","client/pkg/v3.5.7","api/v3.5.7","v3.4.23","v3.5.6","tests/v3.5.6","server/v3.5.6","raft/v3.5.6","pkg/v3.5.6","etcdutl/v3.5.6","etcdctl/v3.5.6","client/v3.5.6","client/v2.305.6","client/pkg/v3.5.6","api/v3.5.6","v3.4.22","v3.4.21","v3.5.5","tests/v3.5.5","server/v3.5.5","raft/v3.5.5","pkg/v3.5.5","etcdutl/v3.5.5","etcdctl/v3.5.5","client/v3.5.5","client/v2.305.5","client/pkg/v3.5.5","api/v3.5.5","v3.4.20","v3.4.19","v3.5.4","tests/v3.5.4","server/v3.5.4","raft/v3.5.4","pkg/v3.5.4","etcdutl/v3.5.4","etcdctl/v3.5.4","client/v3.5.4","client/v2.305.4","client/pkg/v3.5.4","api/v3.5.4","v3.5.3","tests/v3.5.3","server/v3.5.3","raft/v3.5.3","pkg/v3.5.3","etcdutl/v3.5.3","etcdctl/v3.5.3","client/v3.5.3","client/v2.305.3","client/pkg/v3.5.3","api/v3.5.3","v3.5.2","tests/v3.5.2","server/v3.5.2","raft/v3.5.2","pkg/v3.5.2","etcdutl/v3.5.2","etcdctl/v3.5.2","client/v3.5.2","client/v2.305.2","client/pkg/v3.5.2","api/v3.5.2","v3.4.18","v3.5.1","tests/v3.5.1","server/v3.5.1","raft/v3.5.1","pkg/v3.5.1","etcdutl/v3.5.1","etcdctl/v3.5.1","client/v3.5.1","client/v2.305.1","client/pkg/v3.5.1","api/v3.5.1","v3.4.17","v3.5.0","tests/v3.5.0","server/v3.5.0","raft/v3.5.0","pkg/v3.5.0","etcdutl/v3.5.0","etcdctl/v3.5.0","client/v3.5.0","client/v2.305.0","client/pkg/v3.5.0","api/v3.5.0","v3.4.16","v3.4.15","v3.4.14","v3.4.13","v3.4.12","v3.4.11","v3.4.10","v3.4.9","v3.4.8","v3.4.7","v3.4.6","v3.4.5","v3.4.4","v3.4.3","v3.4.2","v3.4.1","v3.4.0","v3.4.0-rc.4","v3.4.0-rc.3","v3.4.0-rc.2","v3.4.0-rc.1","v3.4.0-rc.0","v3.3.9_plus_git","v3.3.0-rc.0","v3.2.10_plus_git","v3.2.0_plus_git","v3.2.0+git","v3.2.0-rc.1","v3.2.0-rc.0","v3.1.0-rc.1","v3.1.0-rc.0","v3.1.0-alpha.1","v3.1.0-alpha.0","v3.0.0-beta.0","v2.3.0","v2.3.0-alpha.1","v2.3.0-alpha.0","v2.2.0","v2.2.0-rc.0","v2.2.0-alpha.1","v2.2.0-alpha.0","v2.1.1","v2.1.0","v2.1.0-rc.0","v2.1.0-alpha.1","v2.1.0-alpha.0","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v0.4.6","v2.0.0-rc.1","v0.5.0-alpha.5","v0.5.0-alpha.4","v0.5.0-alpha.3","v0.5.0-alpha.2","v0.5.0-alpha.1","v0.5.0-alpha.0","v0.4.5","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4.0","v0.3.0","v0.2.0-rc4","v0.2.0","v0.2.0-rc3","v0.2.0-rc2","v0.2.0-rc1","v0.1.2","v0.1.1","v0.1.0","0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44283.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44283.json"},{"type":"ADVISORY","url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44283"}],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44283.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"}]}