{"id":"GO-2026-6114","summary":"Watch API authorization bypass in go.etcd.io/etcd/server/v3","details":"In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey(). The Watch RPC handler normalized open-ended range ends prior to authorization checks, causing isWatchPermitted to evaluate the request as a single-key watch while the underlying watch stream received events for all keys lexicographically greater than or equal to the target key.","aliases":["BIT-etcd-2026-73499","CVE-2026-73499","GHSA-xg4h-6gfc-h4m8"],"modified":"2026-08-19T21:41:58.444900927Z","published":"2026-08-18T16:38:10Z","related":["CGA-xj7j-37c9-523x"],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6114","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8"},{"type":"FIX","url":"https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41"},{"type":"WEB","url":"https://github.com/etcd-io/etcd/releases/tag/v3.5.33"},{"type":"WEB","url":"https://github.com/etcd-io/etcd/releases/tag/v3.6.14"},{"type":"WEB","url":"https://github.com/etcd-io/etcd/releases/tag/v3.7.1"}],"affected":[{"package":{"name":"go.etcd.io/etcd/server/v3","ecosystem":"Go","purl":"pkg:golang/go.etcd.io/etcd/server/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.33"},{"introduced":"3.6.0"},{"fixed":"3.6.14"},{"introduced":"3.7.0-alpha.0"},{"fixed":"3.7.1"}]}],"ecosystem_specific":{"imports":[{"path":"go.etcd.io/etcd/server/v3/etcdserver/api/v3rpc","symbols":["NewWatchServer","Server","serverWatchStream.recvLoop","watchServer.Watch"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6114.json"}}],"schema_version":"1.9.0","credits":[{"name":"Luis Toro (GitHub: lobuhi)"},{"name":"Anthropic"},{"name":"Adam Korczynski (GitHub: AdamKorcz)"}]}