etcd: Authorization bypasses in multiple APIs

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-33413 · CVE overview and exploitation status

EUVD-2026-16191

GHSA-q8m4-xhhv-38mg

BIT-etcd-2026-33413

GO-2026-4806

cve-program · CVE-2026-33413

• https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg

euvd · EUVD-2026-16191

• https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg

nvd · CVE-2026-33413

• https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg

osv · GHSA-q8m4-xhhv-38mg

• https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg
• https://nvd.nist.gov/vuln/detail/CVE-2026-33413
• https://github.com/etcd-io/etcd

osv · GO-2026-4806

• https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg

• etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, unauthorized users may bypass authentication or authorization checks and call certain etcd functions in clusters that e… · Advisory content revised · 15 Nov 2026