CVE-2026-73499 etcd: Watch API authorization bypass via open-ended range requests
Authenticated users with limited read permissions can bypass access controls to monitor unauthorized keys via the Watch API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73499?
CVE-2026-73499 is a high-severity authentication bypass vulnerability in etcd-io etcd, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Weakness: CWE-863
Which versions are affected by CVE-2026-73499?
8 open source packages ship an affected version, including go.etcd.io/etcd/v3, etcd and go.etcd.io/etcd/server/v3.
| Package | Affected | Fixed in |
|---|---|---|
go.etcd.io/etcd/v3 Go | All versions | 3.5.33 |
go.etcd.io/etcd/v3 Go | All versions | 3.5.33 |
go.etcd.io/etcd/v3 Go | From 3.6.0 | 3.6.14 |
go.etcd.io/etcd/v3 Go | From 3.6.0 | 3.6.14 |
go.etcd.io/etcd/v3 Go | From 3.7.0-alpha.0 | 3.7.1 |
go.etcd.io/etcd/v3 Go | From 3.7.0-alpha.0 | 3.7.1 |
2 more packages
etcd Bitnami | All versions | 3.5.33, 3.6.14, 3.7.1 |
go.etcd.io/etcd/server/v3 Go | All versions | 3.5.33, 3.6.14, 3.7.1 |
How do I fix CVE-2026-73499?
Upgrade go.etcd.io/etcd/v3 to a fixed version for your release line: 3.5.33, 3.6.14 or 3.7.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-73499 being exploited?
There is no known exploitation of CVE-2026-73499 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-73499, BIT-etcd-2026-73499, DEBIAN-CVE-2026-73499, ECHO-b25f-a909-5944, GHSA-xg4h-6gfc-h4m8, GO-2026-6114 and 25 more.