etcd: Nested etcd transactions bypass RBAC authorization checks

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-33343 · CVE overview and exploitation status

EUVD-2026-20077

GHSA-rfx7-8w68-q57q

BIT-etcd-2026-33343

GO-2026-4808

cve-program · CVE-2026-33343

• https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q

euvd · EUVD-2026-20077

• https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q

nvd · CVE-2026-33343

• https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q

osv · GHSA-rfx7-8w68-q57q

• https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q
• https://nvd.nist.gov/vuln/detail/CVE-2026-33343
• https://github.com/etcd-io/etcd

osv · GO-2026-4808

• https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q

• etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested transactions to bypass all key-leve… · Advisory content revised · 15 Nov 2026