{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.etcd.io/etcd/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0-alpha.0"
            },
            {
              "fixed": "3.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.etcd.io/etcd/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.6.0"
            },
            {
              "fixed": "3.6.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.etcd.io/etcd/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T22:38:22Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA user granted READ permission on a single, exact key can use the Watch gRPC API with `clientv3.WithFromKey()` (an open-ended, \"from this key to the end of the keyspace\" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key \u2014 not just the one key they were granted. \n\nThis is an authorization bypass in etcd\u0027s RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled \u2014 clusters running without auth already allow unrestricted read access.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThis vulnerability is patched in the following versions:\n\n- etcd 3.7.1\n- etcd 3.6.14\n- etcd 3.5.33\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading is not immediately possible, the following mitigations reduce exposure:\n\n- Audit READ grants. Any READ grant \u2014 even on one key \u2014 can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn\u0027t trust with full read access.\n- Restrict network access. Limit which hosts can reach etcd\u0027s client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.\n\n### Reporter\n\n- Luis Toro ([@lobuhi](https://github.com/lobuhi) on Github)\n- Anthropic  and Adam Korczynski ([@AdamKorcz](https://github.com/AdamKorcz) on Github)",
  "id": "GHSA-xg4h-6gfc-h4m8",
  "modified": "2026-07-24T22:38:22Z",
  "published": "2026-07-24T22:38:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/etcd-io/etcd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "etcd: Watch API authorization bypass via open-ended range requests"
}