etcd: Watch API authorization bypass via open-ended range requests

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-73499 · Microsoft / collected KEV context

GHSA-xg4h-6gfc-h4m8

BIT-etcd-2026-73499

GO-2026-6114

cve-program · CVE-2026-73499

• https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8
• https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
• https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed
• https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae
• https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7
• https://github.com/etcd-io/etcd/releases/tag/v3.5.33
• https://github.com/etcd-io/etcd/releases/tag/v3.6.14
• https://github.com/etcd-io/etcd/releases/tag/v3.7.1

nvd · CVE-2026-73499

• https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
• https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed
• https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae
• https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7
• https://github.com/etcd-io/etcd/releases/tag/v3.5.33
• https://github.com/etcd-io/etcd/releases/tag/v3.6.14
• https://github.com/etcd-io/etcd/releases/tag/v3.7.1
• https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8

osv · GHSA-xg4h-6gfc-h4m8

• https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8
• https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
• https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae
• https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7
• https://github.com/etcd-io/etcd
• https://github.com/etcd-io/etcd/releases/tag/v3.5.33
• https://github.com/etcd-io/etcd/releases/tag/v3.6.14
• https://github.com/etcd-io/etcd/releases/tag/v3.7.1

osv · GO-2026-6114

• https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8
• https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
• https://github.com/etcd-io/etcd/releases/tag/v3.5.33
• https://github.com/etcd-io/etcd/releases/tag/v3.6.14
• https://github.com/etcd-io/etcd/releases/tag/v3.7.1

No related operational record is retained in the current change model.