CVE-2026-73499: 
etcd vulnerability analysis and mitigation

CVE-2026-73499 is an incorrect authorization vulnerability in etcd, a distributed key-value store widely used as the backing store for Kubernetes and other distributed systems. A user granted READ permission on a single exact key can abuse the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key, effectively bypassing RBAC controls. The vulnerability affects etcd versions prior to 3.5.33, 3.6.0–3.6.13, and 3.7.0-alpha.0–3.7.0. It was published on August 12, 2026, and carries a CVSS v4.0 base score of 7.1 (High) (OSV Advisory, Feedly).

The root cause is classified as CWE-863 (Incorrect Authorization). In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel value (a single 0x00 byte sent by clientv3.WithFromKey()) was rewritten to []byte{} before the RBAC permission check executed in server/auth/range_perm_cache.go's isRangeOpPermitted function. Because len([]byte{}) equals 0 — the same as len(nil) — the permission check treated the open-ended range request as an exact single-key point query. A single-key grant satisfied that check, so the watch was created covering [key, +∞) instead of being denied. The fix moves the RangeEnd rewrite to occur after the permission check, ensuring the unmodified sentinel is evaluated against RBAC rules. Only clusters with authentication enabled are affected; Range/Get and DeleteRange requests are not impacted (etcd commit 7cf71ec, etcd commit 6643f80).

Successful exploitation allows a low-privileged authenticated user to receive real-time watch events for all keys in the etcd keyspace that are lexicographically greater than or equal to their permitted key, exposing sensitive configuration data, secrets, and state information stored by applications such as Kubernetes. This is a confidentiality-only impact — integrity and availability are not affected — but in Kubernetes environments, leaked etcd data can include service account tokens, TLS certificates, and cluster configuration, enabling significant lateral movement or privilege escalation. The vulnerability is limited to clusters with authentication enabled and requires valid credentials (OSV Advisory, Feedly).

No public exploit code or in-the-wild exploitation has been reported as of the time of publication. The NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable, as it requires a valid authenticated account with at least single-key READ permission. The EPSS score is 0.00365 (~0.37%), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, OSV Advisory).

1. Obtain credentials: Acquire valid credentials for an etcd account that has been granted READ permission on at least one specific key (e.g., key foo) on a cluster with authentication enabled.
2. Connect to etcd: Establish a gRPC connection to the target etcd cluster using the etcd v3 client library (e.g., clientv3.New(...) with the low-privilege user's credentials).
3. Issue a Watch with WithFromKey(): Call client.Watch(ctx, "foo", clientv3.WithFromKey(), clientv3.WithCreatedNotify()). This sends a Watch request with RangeEnd set to a single 0x00 byte, representing an open-ended >= key range.
4. Bypass RBAC check: On vulnerable versions, the server rewrites RangeEnd from [0x00] to []byte{} before the permission check, causing isRangeOpPermitted to evaluate the request as a single-key watch. The single-key grant satisfies this check.
5. Receive unauthorized events: The watch stream is established covering [foo, +∞). The attacker receives real-time change events for all keys lexicographically greater than or equal to foo, including keys they have no explicit permission to read (etcd commit 7cf71ec, etcd commit afeaa62).

• Network: Persistent gRPC Watch streams from low-privilege client accounts to etcd port (default 2379/2380) that remain open for extended periods; watch requests with RangeEnd set to \x00 (single zero byte) originating from accounts with narrow key permissions.
• Logs: etcd audit logs showing Watch requests from users whose RBAC role grants only single-key READ access, but where the watch key range extends beyond the permitted key (e.g., user test with permission on foo issuing a watch from foo onward); repeated watch creation events from the same low-privilege user.
• Behavioral: A low-privilege etcd user account receiving watch events for keys outside its explicitly granted permission scope; unexpected volume of watch event traffic from accounts with minimal RBAC grants.

Upgrade etcd to a patched release: 3.5.33, 3.6.14, or 3.7.1, which fix the issue by moving the RangeEnd sentinel rewrite to occur after the RBAC permission check (etcd v3.5.33 release, etcd commit 6643f80). As a workaround for environments that cannot immediately upgrade, restrict etcd access so that only fully trusted users are granted any RBAC permissions, and audit existing role bindings to ensure no untrusted accounts hold single-key READ grants. Clusters without authentication enabled are not affected by this vulnerability.