Go/go.etcd.io/etcd/server/v3 CVE-2026-73499: high 7.1, EPSS 0.66%
Watch API authorization bypass in go.etcd.io/etcd/server/v3
Action: Upgrade go.etcd.io/etcd/server/v3 to 3.5.33 or later.
go get go.etcd.io/etcd/server/v3@v3.5.33go get go.etcd.io/etcd/server/v3@v3.6.14go get go.etcd.io/etcd/server/v3@v3.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.5.33 | - |
| 3.6.0 | 3.6.14 | - |
| 3.7.0-alpha.0 | 3.7.1 | - |
Fixed versions
| 3.5.33 | 3.6.14 | 3.7.1 |
Sources
- osv: GO-2026-6114
- nvd: CVE-2026-73499
- https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8
- https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
- https://github.com/etcd-io/etcd/releases/tag/v3.5.33
- https://github.com/etcd-io/etcd/releases/tag/v3.6.14
- https://github.com/etcd-io/etcd/releases/tag/v3.7.1
CVE-2026-73499 · published · modified · JSON