https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T11:34:52.055698+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-44283 CVE-2026-44283 — etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks 2026-10-01T11:34:52.058067+00:00

Affected: etcd-io etcd

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.

 https://vulnerability.circl.lu/vuln/ghsa-x35m-3gp4-4fh5 GHSA-x35m-3gp4-4fh5 — etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests 2026-10-01T11:34:52.058173+00:00

Affected: Go: go.etcd.io/etcd/v3, Go: go.etcd.io/etcd

### Impact _What kind of vulnerability is it? Who is impacted?_

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

### Patches _Has the problem been patched? What versions should users upgrade to?_

This vulnerability is patched in the following versions: - etcd 3.6.11 - etcd 3.5.30 - etcd 3.4.44

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

- restrict network access to etcd server ports so only trusted components can connect - require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

### Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd…