CVEvulnerability

CVE-2026-44283

4.3 MEDIUM Published 2026-05-14 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-05-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
0.0 NONE — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863

Description

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.

Affected configurations

• etcd etcd (< 3.4.44) • etcd etcd (>= 3.5.0 < 3.5.30) • etcd etcd (>= 3.6.0 < 3.6.11)

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References