GHSA-x35m-3gp4-4fh5 etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

• Go go.etcd.io/etcd/v3: >= 3.6.0, < 3.6.11 → fixed in 3.6.11 • Go go.etcd.io/etcd/v3: >= 3.5.0, < 3.5.30 → fixed in 3.5.30 • Go go.etcd.io/etcd: < 3.4.44 → fixed in 3.4.44

Impact _What kind of vulnerability is it? Who is impacted?_ A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected. Patches _Has the problem been patched? What versions should users upgrade to?_ This vulnerability is patched in the following versions: • etcd 3.6.11 • etcd 3.5.30 • etcd 3.4.44 Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice. • restrict network access to etcd server ports so only trusted components can connect • require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution Reporters Samy Ghannad (@SamyGhannad on Github) reported that read access via PrevKv in a Put request within etcd transactions bypassed RBAC authorization checks. Benjamin Wang (@ahrtr ) further analyzed that lease attachment in a Put request within etcd transactions also bypassed RBAC authorization checks