CVE-2026-44283: etcd RBAC Bypass Vulnerability in go.etcd.io/etcd
Summary
CVE-2026-44283: Impact _What kind of vulnerability is it? Affects go.etcd.io/etcd/v3 across 2 version ranges.
>= 3.5.0, < 3.5.30
>= 3.6.0, < 3.6.11
Fixed in 3.5.30 or 3.6.11, depending on the release line you run. How to fix ↓
Also tracked for
- go.etcd.io/etcd/server/v3 · Go
- etcd · Bitnami
The same CVE-2026-44283 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
etcd is a distributed key-value store that provides a reliable way to store data across a cluster of machines. It is commonly used in cloud-native applications, particularly in Kubernetes, for storing configuration data and service discovery. The package is designed to be highly available and resilient, but it has a vulnerability that allows unauthorized access to data under certain conditions.
Vulnerability Detail
A vulnerability in etcd allows read access via PrevKv or lease attachment in Put requests within transaction operations to bypass RBAC authorization checks. This means that an authenticated user without sufficient read or lease-related permissions may access unauthorized data or attach leases by invoking transaction operations with these features enabled. This issue arises from the way etcd handles authorization checks during nested transaction operations.
How To Fix
Latest published version: v3.7.3 as of 23 Oct 2026
go get go.etcd.io/etcd/v3@v3.7.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.5.0, < 3.5.303.5.30go get go.etcd.io/etcd/v3@v3.5.30 -
>= 3.6.0, < 3.6.113.6.11go get go.etcd.io/etcd/v3@v3.6.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, users can reduce exposure by treating the affected RPCs as unauthenticated in practice. This can be achieved by implementing the following measures:
- Restrict network access to etcd server ports so that only trusted components can connect.
- Require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution.
Conclusion
The etcd RBAC bypass vulnerability (CVE-2026-44283) poses a risk of unauthorized data access through transaction operations. Users are advised to upgrade to the latest patched versions to mitigate this risk. Implementing workarounds can also help reduce exposure until an upgrade is feasible.
See every vulnerability recorded for go.etcd.io/etcd/v3 →
FAQ
The vulnerability allows unauthorized data access through RBAC bypass in etcd's transaction operations.
Authenticated users without sufficient read or lease-related permissions may be affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
You can implement workarounds such as restricting network access and requiring strong client identity.
The CVSS score of this vulnerability is 0.0.
References
Related vulnerabilities
Recent vulnerabilities recorded for go.etcd.io/etcd/v3.
