GHSA-xg4h-6gfc-h4m8

Suggest an improvement
Source
https://github.com/advisories/GHSA-xg4h-6gfc-h4m8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-xg4h-6gfc-h4m8/GHSA-xg4h-6gfc-h4m8.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-xg4h-6gfc-h4m8
Aliases
Downstream
CGA (98)
MINI (23)
Published
2026-07-24T22:38:22Z
Modified
2026-08-18T17:25:53Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
etcd: Watch API authorization bypass via open-ended range requests
Details

Impact

What kind of vulnerability is it? Who is impacted?

A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted.

This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability is patched in the following versions:

  • etcd 3.7.1
  • etcd 3.6.14
  • etcd 3.5.33

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading is not immediately possible, the following mitigations reduce exposure:

  • Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.
  • Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

Reporter

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T22:38:22Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

Go / go.etcd.io/etcd/v3

Package

Name
go.etcd.io/etcd/v3
View open source insights on deps.dev
Purl
pkg:golang/go.etcd.io/etcd/v3

Affected ranges

Type
SEMVER
Events
Introduced
3.7.0-alpha.0
Fixed
3.7.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-xg4h-6gfc-h4m8/GHSA-xg4h-6gfc-h4m8.json"

Go / go.etcd.io/etcd/v3

Package

Name
go.etcd.io/etcd/v3
View open source insights on deps.dev
Purl
pkg:golang/go.etcd.io/etcd/v3

Affected ranges

Type
SEMVER
Events
Introduced
3.6.0
Fixed
3.6.14

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-xg4h-6gfc-h4m8/GHSA-xg4h-6gfc-h4m8.json"

Go / go.etcd.io/etcd/v3

Package

Name
go.etcd.io/etcd/v3
View open source insights on deps.dev
Purl
pkg:golang/go.etcd.io/etcd/v3

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.5.33

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-xg4h-6gfc-h4m8/GHSA-xg4h-6gfc-h4m8.json"