CVE-2026-44283 etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks
Authenticated users can bypass RBAC checks to read unauthorized data or attach leases via etcd transaction operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44283?
CVE-2026-44283 is a missing authorization vulnerability in etcd-io etcd, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.
Weakness: CWE-863
Which versions are affected by CVE-2026-44283?
8 open source packages ship an affected version, including go.etcd.io/etcd/v3, etcd and go.etcd.io/etcd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
go.etcd.io/etcd/v3 Go | From 3.5.0 | 3.5.30 |
go.etcd.io/etcd/v3 Go | From 3.5.0 | 3.5.30 |
go.etcd.io/etcd/v3 Go | From 3.6.0 | 3.6.11 |
go.etcd.io/etcd/v3 Go | From 3.6.0 | 3.6.11 |
etcd Bitnami | All versions | 3.4.44, 3.5.30, 3.6.11 |
go.etcd.io/etcd Go | All versions | 3.4.44 |
2 more packages
go.etcd.io/etcd Go | All versions | 3.4.44 |
go.etcd.io/etcd/server/v3 Go | From 3.5.0 | 3.5.30, 3.6.11 |
Linux distribution packages (1)
flannel openSUSE:Tumbleweed | All versions | 0.28.5-1.1 |
Products include Etcd Etcd.
How do I fix CVE-2026-44283?
Upgrade go.etcd.io/etcd/v3 to a fixed version for your release line: 3.5.30 or 3.6.11.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-44283 being exploited?
There is no known exploitation of CVE-2026-44283 in the wild and no public exploit code.
Other vulnerabilities in etcd-io etcd
- CVE-2021-28235 Etcd-io Improper Authentication vulnerability
- CVE-2026-33413 etcd: Authorization bypasses in multiple APIs
- CVE-2022-34038 Denial of service in n/a
- CVE-2018-16886 go.etcd.io/etcd Authentication Bypass
- CVE-2026-59818 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
Sources
Also known as AZL-86898, BELL-CVE-2026-44283, BIT-etcd-2026-44283, DEBIAN-CVE-2026-44283, ECHO-62a3-49c9-6673, GHSA-x35m-3gp4-4fh5 and 24 more.