tocsin

CVE-2026-44283

3 advisories.

Go/go.etcd.io/etcd/v3 CVE-2026-44283: unknown 0

etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

Action: Upgrade go.etcd.io/etcd/v3 to 3.5.30 or later.

go get go.etcd.io/etcd/v3@v3.6.11
go get go.etcd.io/etcd/v3@v3.5.30

Affected

introducedfixedlast affected
3.6.03.6.11-
3.5.03.5.30-

Fixed versions

3.6.113.5.30

Sources

CVE-2026-44283 · published · modified · JSON

Go/go.etcd.io/etcd CVE-2026-44283: unknown 0

etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

Action: Upgrade go.etcd.io/etcd to 3.4.44 or later.

go get go.etcd.io/etcd@v3.4.44

Affected

introducedfixedlast affected
03.4.44-

Fixed versions

3.4.44

Sources

CVE-2026-44283 · published · modified · JSON

Go/go.etcd.io/etcd/server/v3 CVE-2026-44283: unknown

Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server

Action: Upgrade go.etcd.io/etcd/server/v3 to 3.5.30 or later.

go get go.etcd.io/etcd/server/v3@v3.5.30
go get go.etcd.io/etcd/server/v3@v3.6.11

Affected

introducedfixedlast affected
3.5.03.5.30-
3.6.03.6.11-

Fixed versions

3.5.303.6.11

Sources

CVE-2026-44283 · published · modified · JSON