CVE-2026-73499

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

• CWE-863

• https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
• https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed
• https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae
• https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7
• https://github.com/etcd-io/etcd/releases/tag/v3.5.33
• https://github.com/etcd-io/etcd/releases/tag/v3.6.14
• https://github.com/etcd-io/etcd/releases/tag/v3.7.1
• https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8

Published

Aug 12, 2026

Last Modified

Aug 14, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73490Loofah is a general library for manipulating and transformin…4.7
• CVE-2026-73491Loofah is a general library for manipulating and transformin…2.3
• CVE-2026-73492Loofah is a general library for manipulating and transformin…2.3
• CVE-2026-73493Http4s (http4s-blaze-server) is a minimal, idiomatic Scala i…7.5
• CVE-2026-73495blaze is a Scala library for building asynchronous pipelines…7.4
• CVE-2026-73498MCP Atlassian is a Model Context Protocol (MCP) server for A…7.7
• CVE-2026-7350Use after free in WebMIDI in Google Chrome prior to 147.0.77…8.3
• CVE-2026-73500etcd is a distributed key-value store for the data of a dist…8.7
• CVE-2026-73501kin-openapi is a Go project for handling OpenAPI files. Prio…9.1
• CVE-2026-73502kin-openapi is a Go project for handling OpenAPI files. From…5.3
• CVE-2026-73505Oh My Posh is the most customisable and low-latency cross pl…7.8
• CVE-2026-73506Oh My Posh is the most customisable and low-latency cross pl…6.1