Go/go.etcd.io/etcd/server/v3 CVE-2026-44283: unknown, EPSS 0.22%

Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server

Action: Upgrade go.etcd.io/etcd/server/v3 to 3.5.30 or later.

go get go.etcd.io/etcd/server/v3@v3.5.30

go get go.etcd.io/etcd/server/v3@v3.6.11

Affected

Fixed versions

Sources

• osv: GO-2026-5736
• https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5

CVE-2026-44283 · published 2026-07-24T18:35:55Z · modified 2026-07-25T15:44:46.961229468Z · JSON