{"id":"GO-2026-6114","revision":"39bdc64af6b9499ba8907a176dfce707","records":[{"revision":"39bdc64af6b9499ba8907a176dfce707","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6114","aliases":["BIT-etcd-2026-73499","CVE-2026-73499","GHSA-xg4h-6gfc-h4m8"],"title":"Watch API authorization bypass in go.etcd.io/etcd/server/v3","description":"In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey(). The Watch RPC handler normalized open-ended range ends prior to authorization checks, causing isWatchPermitted to evaluate the request as a single-key watch while the underlying watch stream received events for all keys lexicographically greater than or equal to the target key.","state":0,"publishedAt":"2026-08-18T16:38:10+00:00","modifiedAt":"2026-08-19T21:41:58.4449009+00:00","affected":[{"ecosystem":"Go","name":"go.etcd.io/etcd/server/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.5.33"},{"kind":"introduced","version":"3.6.0"},{"kind":"fixed","version":"3.6.14"},{"kind":"introduced","version":"3.7.0-alpha.0"},{"kind":"fixed","version":"3.7.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8","https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41","https://github.com/etcd-io/etcd/releases/tag/v3.5.33","https://github.com/etcd-io/etcd/releases/tag/v3.6.14","https://github.com/etcd-io/etcd/releases/tag/v3.7.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6114","license":"OSV · upstream source license applies","key":"osv:GO-2026-6114","identifiers":["GO-2026-6114","BIT-etcd-2026-73499","CVE-2026-73499","GHSA-xg4h-6gfc-h4m8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}