GHSA-xg4h-6gfc-h4m8: etcd: Watch API authorization bypass via open-ended range requests
Summary
etcd (a distributed database system) has an authorization bypass vulnerability in its Watch API where users with READ permission on a single key can use `clientv3.WithFromKey()` (an open-ended request that watches from one key to the end of all stored keys) to see watch events for every key after their permitted key, not just their one allowed key. This only affects etcd clusters with authentication enabled.
Solution / Mitigation
Upgrade to etcd 3.7.1, etcd 3.6.14, or etcd 3.5.33. If upgrading is not immediately possible, audit all READ permission grants and revoke or restrict any you wouldn't trust with full read access, and use firewall rules or network policies to limit which hosts can connect to etcd's client port.
Classification
Affected Vendors
Affected Packages
Original source: https://github.com/advisories/GHSA-xg4h-6gfc-h4m8
First tracked: July 24, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 75%