From 59a16f0d724f283f015e3febdbcd008bd334f8a4 Mon Sep 17 00:00:00 2001 From: Wilfredo Ramos De Guzman Jr <70294480+01ithub@users.noreply.github.com> Date: Sun, 18 Oct 2026 12:53:00 +0800 Subject: [PATCH] Improve GHSA-xg4h-6gfc-h4m8 --- .../2026/07/GHSA-xg4h-6gfc-h4m8/GHSA-xg4h-6gfc-h4m8.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/advisories/github-reviewed/2026/07/GHSA-xg4h-6gfc-h4m8/GHSA-xg4h-6gfc-h4m8.json b/advisories/github-reviewed/2026/07/GHSA-xg4h-6gfc-h4m8/GHSA-xg4h-6gfc-h4m8.json index b95acc51818b..d2055fbdbccf 100644 --- a/advisories/github-reviewed/2026/07/GHSA-xg4h-6gfc-h4m8/GHSA-xg4h-6gfc-h4m8.json +++ b/advisories/github-reviewed/2026/07/GHSA-xg4h-6gfc-h4m8/GHSA-xg4h-6gfc-h4m8.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-xg4h-6gfc-h4m8", - "modified": "2026-08-12T21:20:37Z", + "modified": "2026-08-12T21:20:38Z", "published": "2026-07-24T22:38:22Z", "aliases": [ "CVE-2026-73499" ], "summary": "etcd: Watch API authorization bypass via open-ended range requests", - "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA user granted READ permission on a single, exact key can use the Watch gRPC API with `clientv3.WithFromKey()` (an open-ended, \"from this key to the end of the keyspace\" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted. \n\nThis is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThis vulnerability is patched in the following versions:\n\n- etcd 3.7.1\n- etcd 3.6.14\n- etcd 3.5.33\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading is not immediately possible, the following mitigations reduce exposure:\n\n- Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.\n- Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.\n\n### Reporter\n\n- Luis Toro ([@lobuhi](https://github.com/lobuhi) on Github)\n- Anthropic and Adam Korczynski ([@AdamKorcz](https://github.com/AdamKorcz) on Github)", + "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA user granted READ permission on a single, exact key can use the Watch gRPC API with `clientv3.WithFromKey()` (an open-ended, \"from this key to the end of the keyspace\" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted. \n\nThis is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThis vulnerability is patched in the following versions:\n\n- etcd 3.7.19\n- etcd 3.6.14\n- etcd 3.5.33\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading is not immediately possible, the following mitigations reduce exposure:\n\n- Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access.\n- Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.\n\n### Reporter\n\n- Luis Toro ([@lobuhi](https://github.com/lobuhi) on Github)\n- Anthropic and Adam Korczynski ([@AdamKorcz](https://github.com/AdamKorcz) on Github)", "severity": [ { "type": "CVSS_V4",