PT-2026-26755 · Etcd · Etcd

Published 2026-01-01 · Updated 2026-04-07 · CVE-2026-33343

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.4.42 etcd versions prior to 3.5.28 etcd versions prior to 3.6.9

Description An authenticated user with Role-Based Access Control (RBAC) restricted permissions on key ranges can bypass key-level authorization using nested transactions. This allows any authenticated user with direct access to the etcd data store to ignore key range restrictions and access the entire data store. Kubernetes deployments that rely on the API server for authentication and authorization are not affected.

Recommendations Upgrade to etcd version 3.4.42 or later. Upgrade to etcd version 3.5.28 or later. Upgrade to etcd version 3.6.9 or later. If upgrading is not immediately possible, treat the affected Remote Procedure Calls (RPCs) as unauthenticated. Restrict network access to etcd server ports to only trusted components. Require strong client identity at the transport layer, such as mutual Transport Layer Security (mTLS) with tightly scoped client certificate distribution.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-ETCD-2026-33343

CVE-2026-33343

GHSA-RFX7-8W68-Q57Q

GO-2026-4808

Affected Products

Etcd

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33343.json · Exploit
• https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33343 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33343 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33343 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33343 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-etcd-2026-33343 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33343 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33343 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33343 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rfx7-8w68-q57q · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4808 · Vendor Advisory
• https://github.com/etcd-io/etcd · Note
• https://twitter.com/CVEnew/status/2038135210668396842 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33343 · Note