{"uuid": "c5a65594-7570-4030-a745-9950ed50240e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-XG4H-6GFC-H4M8", "type": "seen", "source": "https://gist.github.com/alon710/0779a48575ed13d9f77e2dad5309ea43", "content": "# GHSA-XG4H-6GFC-H4M8: GHSA-XG4H-6GFC-H4M8: Watch API Authorization Bypass via Open-Ended Range Requests in etcd\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-XG4H-6GFC-H4M8\n\n## Summary\nAn authorization bypass vulnerability in the gRPC Watch API of etcd allows low-privileged users to read keys outside of their authorized range. By utilizing an open-ended range request sentinel, the input is prematurely normalized before RBAC validation, misclassifying a range watch as a single-key point query.\n\n## TL;DR\nA premature normalization flaw in etcd's gRPC Watch handler allows users with read permission for a single key to bypass RBAC and watch all lexicographically greater keys.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network (gRPC API)\n- **CVSS Score**: 6.5 (Medium)\n- **Exploit Status**: PoC available via etcd integration tests\n- **KEV Status**: Not listed\n- **Impact**: Unauthorized read access to adjacent or global key namespaces\n- **Affected Component**: gRPC Watch API (recvLoop in watch.go)\n\n## Affected Systems\n\n- etcd distributed key-value store\n- **etcd**: >= 3.5.0, < 3.5.33 (Fixed in: `v3.5.33`)\n- **etcd**: >= 3.6.0, < 3.6.14 (Fixed in: `v3.6.14`)\n- **etcd**: >= 3.7.0, < 3.7.1 (Fixed in: `v3.7.1`)\n\n## Mitigation\n\n- Upgrade etcd to a secure, patched version (v3.5.33+, v3.6.14+, or v3.7.1+).\n- Monitor etcd gRPC audit logs for abnormal Watch API requests using the open-ended sentinel.\n- Avoid granting fine-grained single-key read permissions adjacent to sensitive namespaces.\n- Implement network-level access control to restrict client connections to the gRPC API.\n\n**Remediation Steps:**\n1. Identify running etcd versions across all cluster nodes.\n2. Apply the patch by updating the etcd binary or container image to v3.5.33, v3.6.14, or v3.7.1.\n3. Verify that auth is enabled and RBAC rules are properly structured.\n4. Incorporate integration-level validation to test user permissions.\n\n## References\n\n- [etcd v3.5.x Fix Commit](https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7)\n- [etcd v3.6.x Fix Commit](https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae)\n- [etcd v3.7.x Fix Commit](https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-XG4H-6GFC-H4M8) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T03:31:51.635898Z"}