CVE-2026-44283: 
etcd vulnerability analysis and mitigation

CVE-2026-44283 is an RBAC authorization bypass vulnerability in etcd, a distributed key-value store, that allows authenticated users to access unauthorized data or attach leases by exploiting PrevKv or lease attachment options in Put requests nested within transaction operations. It affects etcd versions up to and including 3.4.43, 3.5.0–3.5.29, and 3.6.0–3.6.10. The vulnerability was reported by Samy Ghannad and further analyzed by Benjamin Wang (@ahrtr), with the advisory first published on May 1, 2026 and added to the GitHub Advisory Database on May 7, 2026. The CVSS v3.1 score from Feedly threat intelligence is 4.3 (Medium), while the GitHub Advisory Database rates it as Low (0.0) (GitHub Advisory, etcd Security Advisory).

The vulnerability is classified as CWE-863 (Incorrect Authorization) and stems from etcd's RBAC enforcement failing to properly check permissions when the PrevKv flag is set on a Put request, or when a lease is attached to a Put request, inside a transaction (Txn) operation. Specifically, the authorization layer does not validate that the requesting user holds the necessary read or lease-related permissions before returning the previous key-value or attaching the lease, allowing the operation to succeed despite insufficient privileges. The attack vector is network-based, requires low privileges (an authenticated etcd account), and no user interaction. Notably, Kubernetes deployments are not affected because Kubernetes uses its own API server for authentication and authorization rather than etcd's built-in RBAC (GitHub Advisory, etcd Security Advisory).

An authenticated etcd user with limited permissions can exploit this vulnerability to read key-value data they are not authorized to access (via PrevKv) or attach leases to keys beyond their permitted scope (via lease attachment in Put requests within transactions). The primary impact is a confidentiality breach — unauthorized disclosure of sensitive configuration or state data stored in etcd — with no direct integrity or availability impact. Environments using etcd's native RBAC for multi-tenant access control are most at risk, while standard Kubernetes deployments are explicitly not affected (GitHub Advisory, etcd Security Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-44283. The EPSS score is approximately 0.012% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated etcd account, limiting the attacker pool to users who already have some level of access to the etcd cluster (GitHub Advisory).

1. Obtain authenticated access: Acquire valid etcd credentials (username/password or client certificate) for an account with limited permissions — for example, write-only access to a specific key prefix, but no read permissions.
2. Craft a transaction request: Construct an etcd Txn (transaction) RPC request containing a Put operation targeting a key the attacker is permitted to write.
3. Enable PrevKv flag: Set the PrevKv option on the Put request within the transaction. This instructs etcd to return the previous value of the key in the response.
4. Submit the transaction: Send the crafted transaction to the etcd gRPC endpoint (default port 2379). Due to the authorization bypass, etcd returns the previous key-value data without verifying the caller holds read permissions.
5. Alternatively, attach a lease: Craft a Put request within a transaction that attaches a lease ID the attacker does not have permission to use, bypassing lease-related RBAC checks.
6. Collect unauthorized data: Parse the transaction response to extract the returned key-value data or confirm successful lease attachment, achieving unauthorized data access or resource control (GitHub Advisory, etcd Security Advisory).

• Network: Unusual or repeated Txn (transaction) RPC calls to etcd port 2379 from clients that typically only perform write operations; gRPC traffic patterns showing Put requests with PrevKv flags from low-privilege accounts.
• Logs: etcd audit logs showing authenticated users invoking Txn operations with PrevKv=true or lease attachment on keys outside their normal access scope; repeated transaction requests from accounts not expected to perform read operations.
• Behavioral: Authenticated etcd users issuing transaction requests at unusual times or frequencies inconsistent with their normal application role; accounts with write-only roles receiving non-empty PrevKv responses in transaction replies.

Upgrade etcd to one of the patched versions: 3.4.44, 3.5.30, or 3.6.11. If immediate upgrading is not possible, restrict network access to etcd server ports (default 2379/2380) so that only trusted, known components can connect. Additionally, enforce strong client identity at the transport layer using mutual TLS (mTLS) with tightly scoped client certificate distribution to limit which clients can authenticate to etcd at all (GitHub Advisory, etcd Security Advisory).