DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-XG4H-6GFC-H4M8: GHSA-XG4H-6GFC-H4M8: Watch API Authorization Bypass via Open-Ended Range Requests in etcd

#security #cve #cybersecurity #ghsa

GHSA-XG4H-6GFC-H4M8: Watch API Authorization Bypass via Open-Ended Range Requests in etcd

Vulnerability ID: GHSA-XG4H-6GFC-H4M8
CVSS Score: 6.5
Published: 2026-07-24

An authorization bypass vulnerability in the gRPC Watch API of etcd allows low-privileged users to read keys outside of their authorized range. By utilizing an open-ended range request sentinel, the input is prematurely normalized before RBAC validation, misclassifying a range watch as a single-key point query.

TL;DR

A premature normalization flaw in etcd's gRPC Watch handler allows users with read permission for a single key to bypass RBAC and watch all lexicographically greater keys.

Technical Details

  • CWE ID: CWE-863 (Incorrect Authorization)
  • Attack Vector: Network (gRPC API)
  • CVSS Score: 6.5 (Medium)
  • Exploit Status: PoC available via etcd integration tests
  • KEV Status: Not listed
  • Impact: Unauthorized read access to adjacent or global key namespaces
  • Affected Component: gRPC Watch API (recvLoop in watch.go)

Affected Systems

  • etcd distributed key-value store
  • etcd: >= 3.5.0, < 3.5.33 (Fixed in: v3.5.33)
  • etcd: >= 3.6.0, < 3.6.14 (Fixed in: v3.6.14)
  • etcd: >= 3.7.0, < 3.7.1 (Fixed in: v3.7.1)

Code Analysis

Commit: e863b00

Fix Watch API authorization bypass via open-ended range requests on v3.5.x

Commit: afeaa62

Fix Watch API authorization bypass via open-ended range requests on v3.6.x

Commit: 6643f80

Fix Watch API authorization bypass via open-ended range requests on v3.7.x

Mitigation Strategies

  • Upgrade etcd to a secure, patched version (v3.5.33+, v3.6.14+, or v3.7.1+).
  • Monitor etcd gRPC audit logs for abnormal Watch API requests using the open-ended sentinel.
  • Avoid granting fine-grained single-key read permissions adjacent to sensitive namespaces.
  • Implement network-level access control to restrict client connections to the gRPC API.

Remediation Steps:

  1. Identify running etcd versions across all cluster nodes.
  2. Apply the patch by updating the etcd binary or container image to v3.5.33, v3.6.14, or v3.7.1.
  3. Verify that auth is enabled and RBAC rules are properly structured.
  4. Incorporate integration-level validation to test user permissions.

References

Read the full report for GHSA-XG4H-6GFC-H4M8 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)