Most recent entries from all

bdu:2026-15311

BELL-CVE-2026-44283

Affected: Alpaquita:25: etcd, Alpaquita:stream: etcd

BIT-etcd-2026-44283 — etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks

Affected: Bitnami: etcd

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.

EUVD-2026-319109

fkie_cve-2026-44283

GHSA-x35m-3gp4-4fh5 — etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

Affected: Go: go.etcd.io/etcd/v3, Go: go.etcd.io/etcd

### Impact _What kind of vulnerability is it? Who is impacted?_

A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled.

Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected.

### Patches _Has the problem been patched? What versions should users upgrade to?_

This vulnerability is patched in the following versions: - etcd 3.6.11 - etcd 3.5.30 - etcd 3.4.44

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.

- restrict network access to etcd server ports so only trusted components can connect - require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution

### Reporters

Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd…

msrc_CVE-2026-44283 — etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks

msrc_CVE-2026-44283

openSUSE-SU-2026:10980-1 — flannel-0.28.5-1.1 on GA media

flannel-0.28.5-1.1 on GA media

RHSA-2026:44868 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

etcd: etcd: Authenticated user can bypass RBAC for unauthorized data access etcd: etcd: Authentication bypass due to improper Certificate Revocation List enforcement on gRPC listener etcd: etcd: Denial of Service via unbounded TLS handshake goroutines

UBUNTU-CVE-2026-44283

Affected: Ubuntu:16.04:LTS: etcd, Ubuntu:Pro:18.04:LTS: etcd, Ubuntu:Pro:20.04:LTS: etcd, Ubuntu:Pro:22.04:LTS: etcd, Ubuntu:Pro:24.04:LTS: etcd, Ubuntu:25.10: etcd, Ubuntu:Pro:26.04:LTS: etcd

WID-SEC-W-2026-1400 — etcd: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in etcd ausnutzen, um Sicherheitsvorkehrungen zu umgehen.