CVE-2026-73499

{
  "id": "CVE-2026-73499",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T22:17:17.130",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1."
    },
    {
      "lang": "es",
      "value": "etcd es un almacén distribuido de clave-valor para los datos de un sistema distribuido. Antes de las versiones 3.5.33, 3.6.14 y 3.7.1, un usuario al que se le concedió permiso de LECTURA en una única clave exacta puede usar la API gRPC de Watch con clientv3.WithFromKey() para recibir eventos de observación para cada clave lexicográficamente mayor o igual que la clave permitida. En server/etcdserver/api/v3rpc/watch.go, el centinela RangeEnd de rango abierto se reescribe antes de la verificación de permisos RBAC en la función isRangeOpPermitted de server/auth/range_perm_cache.go, lo que hace que la solicitud se trate como una observación de clave exacta. Las solicitudes de Range/Get y DeleteRange no se ven afectadas, y el problema afecta solo a los clústeres con la autenticación habilitada. Este problema se corrige en las versiones 3.5.33, 3.6.14 y 3.7.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "etcd-io",
          "product": "etcd",
          "versions": [
            {
              "version": "< 3.5.33",
              "status": "affected"
            },
            {
              "version": ">= 3.6.0, < 3.6.14",
              "status": "affected"
            },
            {
              "version": ">= 3.7.0-alpha.0, < 3.7.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-14T22:19:48.980697Z",
          "id": "CVE-2026-73499",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8",
      "source": "[email protected]"
    }
  ]
}