PT-2026-38402 · Etcd · Etcd

Samyghannad · Published 2026-05-01 · Updated 2026-06-09 · CVE-2026-44283

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.4.44 etcd versions prior to 3.5.30 etcd versions prior to 3.6.11

Description etcd is a distributed key-value store for distributed system data. A flaw allows authenticated users without sufficient read or lease-related permissions to bypass Role-Based Access Control (RBAC) authorization checks. This occurs when invoking transaction operations that utilize read access via PrevKv or lease attachment in 'Put' requests, potentially allowing unauthorized data access or lease attachment.

Recommendations Update to version 3.4.44. Update to version 3.5.30. Update to version 3.6.11. Restrict network access to etcd server ports to ensure only trusted components can connect. Require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution.

Fix

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-ETCD-2026-44283

CVE-2026-44283

GHSA-X35M-3GP4-4FH5

OPENSUSE-SU-2026:10980-1

Affected Products

Etcd

References · 16

• https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-44283 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44283 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44283 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10980-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44283 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-44283 · Security Note
• https://osv.dev/vulnerability/GHSA-x35m-3gp4-4fh5 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44283 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-etcd-2026-44283 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44283 · Vendor Advisory
• https://github.com/etcd-io/etcd · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-44283 · Note
• https://suse.com/security/cve/CVE-2026-44283 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44283 · Note