CVE-2026-73499: 
etcd vulnerability analysis and mitigation

CVE-2026-73499 is an incorrect authorization vulnerability in etcd, a distributed key-value store widely used as the backing store for Kubernetes and other distributed systems. A user granted READ permission on a single exact key can exploit the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key — effectively bypassing RBAC controls. Affected versions are etcd prior to 3.5.33, 3.6.0–3.6.13, and 3.7.0-alpha.0–3.7.0; the vulnerability only impacts clusters with authentication enabled. It carries a CVSS v4.0 base score of 7.1 (High) (Feedly, OSV).

The root cause is a sequencing error in server/etcdserver/api/v3rpc/watch.go (CWE-863: Incorrect Authorization). When a Watch request arrives with RangeEnd set to a single 0x00 byte — the wire sentinel used by clientv3.WithFromKey() to express an open-ended >= key query — the server previously rewrote this sentinel to []byte{} before passing the request to the RBAC permission check in server/auth/range_perm_cache.go's isRangeOpPermitted function. Because len([]byte{}) == 0 is indistinguishable from len(nil) == 0, the permission check treated the open-ended range request as an exact single-key point query, which the user's single-key grant satisfied. The watch was therefore created covering [key, +∞) instead of being denied. The fix moves the RangeEnd rewrite to occur after the permission check, so the unmodified sentinel is evaluated correctly (GitHub Commit 7cf71ec, GitHub Commit 6643f80).

Successful exploitation allows a low-privileged authenticated user to receive real-time watch events for all keys in the etcd keyspace that are lexicographically greater than or equal to their permitted key, exposing data they are not authorized to read. In Kubernetes environments, this could leak secrets, configuration maps, service account tokens, and other sensitive cluster state stored in etcd. Integrity and availability are not directly affected; only confidentiality is impacted. Range/Get and DeleteRange operations are not affected by this vulnerability (Feedly, OSV).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.365%, indicating low near-term exploitation probability. The vulnerability requires a valid authenticated account with at least READ permission on one key, making unauthenticated exploitation impossible; clusters without authentication enabled are not affected. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" with technical impact rated "partial" (Feedly).

1. Obtain credentials: Acquire valid credentials for an etcd user account that has been granted READ permission on at least one specific key (e.g., key foo) in a cluster with authentication enabled.
2. Connect to etcd: Establish a gRPC connection to the etcd cluster using the etcd v3 client library (e.g., clientv3.New(clientv3.Config{Endpoints: ["<etcd-host>:2379"], Username: "test", Password: "testPassword"})).
3. Issue a privileged Watch request: Call client.Watch(ctx, "foo", clientv3.WithFromKey(), clientv3.WithCreatedNotify()). The WithFromKey() option sets RangeEnd to []byte{0x00}, which signals an open-ended >= foo watch.
4. Bypass RBAC: On vulnerable versions, the server rewrites RangeEnd from 0x00 to []byte{} before the permission check, causing the RBAC layer to evaluate the request as a single-key exact match for foo, which the user's grant satisfies.
5. Receive unauthorized events: The watch stream is established covering [foo, +∞). Any key written by any user that is lexicographically >= foo (e.g., foo1, foobar, secret, z) will generate watch events delivered to the attacker's client, exposing key names and values they are not authorized to read (GitHub Commit 7cf71ec).

• Network: Persistent gRPC Watch streams (long-lived connections on port 2379) from a low-privileged user account that are not consistent with that account's expected access patterns.
• Logs: etcd audit logs showing Watch requests from a user with a single-key permission grant where the range_end field is set (indicating a range watch rather than a point watch); look for Watch operations with key=<permitted-key> and a non-empty range_end from accounts with minimal RBAC grants.
• Behavioral: A user account with a narrow single-key READ role receiving watch events for keys outside its granted scope — detectable by correlating audit log entries for Watch creation with the user's defined RBAC role permissions.

Upgrade etcd to a patched release: v3.5.33, v3.6.14, or v3.7.1. No configuration-based workaround is available; the only remediation is upgrading to a fixed version. As an interim measure, operators can audit RBAC roles to ensure no untrusted users hold any READ permissions on keys in sensitive namespaces, and consider temporarily disabling or restricting network access to the etcd gRPC port (2379) for non-essential clients. Clusters with authentication disabled are not affected by this specific vulnerability (etcd v3.5.33 Release, OSV).