go.etcd.io/etcd/v3

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.6.11
• etcd 3.5.30
• etcd 3.4.44

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

• restrict network access to etcd server ports so only trusted components can connect
• require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Impact

What kind of vulnerability is it? Who is impacted?

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

VMware By Broadcom

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

• etcd 3.7.1
• etcd 3.6.14
• etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

• Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
• Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

• Luis Toro (@lobuhi on Github)
• Anthropic and Adam Korczynski (@AdamKorcz on Github)

Authorization bypasses in multiple APIs in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd