GO-2026-6114Published

Watch API authorization bypass in go.etcd.io/etcd/server/v3

Exact source revision recorded 24 Oct 2026 13:19:41 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

osv · GO-2026-6114

Published

In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey(). The Watch RPC handler normalized open-ended range ends prior to authorization checks, causing isWatchPermitted to evaluate the request as a single-key watch while the underlying watch stream received events for all keys lexicographically greater than or equal to the target key.

Source published: 18 Aug 2026 16:38:10 UTC
Source modified: 19 Aug 2026 21:41:58 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.