{"schema_version":"1.9.0","id":"GHSA-x35m-3gp4-4fh5","published":"2026-05-07T03:21:53Z","modified":"2026-09-10T03:51:07.211759765Z","aliases":["BIT-etcd-2026-44283","CVE-2026-44283","GO-2026-5736"],"summary":"etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests","details":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.\n\nKubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThis vulnerability is patched in the following versions:\n- etcd 3.6.11\n- etcd 3.5.30\n- etcd 3.4.44\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading is not immediately possible, reduce exposure by treating the affected\nRPCs as unauthenticated in practice.\n\n- restrict network access to etcd server ports so only trusted components can connect\n- require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate\ndistribution\n\n### Reporters\n\nSamy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks","affected":[{"package":{"name":"go.etcd.io/etcd/v3","ecosystem":"Go","purl":"pkg:golang/go.etcd.io/etcd/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.6.0"},{"fixed":"3.6.11"}]}],"database_specific":{"last_known_affected_version_range":"<= 3.6.10","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-x35m-3gp4-4fh5/GHSA-x35m-3gp4-4fh5.json"}},{"package":{"name":"go.etcd.io/etcd/v3","ecosystem":"Go","purl":"pkg:golang/go.etcd.io/etcd/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0"},{"fixed":"3.5.30"}]}],"database_specific":{"last_known_affected_version_range":"<= 3.5.29","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-x35m-3gp4-4fh5/GHSA-x35m-3gp4-4fh5.json"}},{"package":{"name":"go.etcd.io/etcd","ecosystem":"Go","purl":"pkg:golang/go.etcd.io/etcd"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.44"}]}],"database_specific":{"last_known_affected_version_range":"<= 3.4.43","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-x35m-3gp4-4fh5/GHSA-x35m-3gp4-4fh5.json"}}],"references":[{"type":"WEB","url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44283"},{"type":"PACKAGE","url":"https://github.com/etcd-io/etcd"}],"database_specific":{"cwe_ids":["CWE-863"],"github_reviewed":true,"github_reviewed_at":"2026-05-07T03:21:53Z","nvd_published_at":"2026-05-14T18:16:49Z","severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"}]}