CVE-2026-73499
2 advisories.
Go/go.etcd.io/etcd/v3 CVE-2026-73499: high, EPSS 0.66%
etcd: Watch API authorization bypass via open-ended range requests
Action: Upgrade go.etcd.io/etcd/v3 to 3.5.33 or later.
go get go.etcd.io/etcd/v3@v3.7.1go get go.etcd.io/etcd/v3@v3.6.14go get go.etcd.io/etcd/v3@v3.5.33Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.7.0-alpha.0 | 3.7.1 | - |
| 3.6.0 | 3.6.14 | - |
| 0 | 3.5.33 | - |
Fixed versions
| 3.7.1 | 3.6.14 | 3.5.33 |
Sources
- osv: GHSA-xg4h-6gfc-h4m8
- https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8
- https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
- https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae
- https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7
- https://github.com/etcd-io/etcd
- https://github.com/etcd-io/etcd/releases/tag/v3.5.33
- https://github.com/etcd-io/etcd/releases/tag/v3.6.14
- https://github.com/etcd-io/etcd/releases/tag/v3.7.1
CVE-2026-73499 · published · modified · JSON
Go/go.etcd.io/etcd/server/v3 CVE-2026-73499: unknown, EPSS 0.66%
Watch API authorization bypass in go.etcd.io/etcd/server/v3
Action: Upgrade go.etcd.io/etcd/server/v3 to 3.5.33 or later.
go get go.etcd.io/etcd/server/v3@v3.5.33go get go.etcd.io/etcd/server/v3@v3.6.14go get go.etcd.io/etcd/server/v3@v3.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.5.33 | - |
| 3.6.0 | 3.6.14 | - |
| 3.7.0-alpha.0 | 3.7.1 | - |
Fixed versions
| 3.5.33 | 3.6.14 | 3.7.1 |
Sources
- osv: GO-2026-6114
- https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8
- https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41
- https://github.com/etcd-io/etcd/releases/tag/v3.5.33
- https://github.com/etcd-io/etcd/releases/tag/v3.6.14
- https://github.com/etcd-io/etcd/releases/tag/v3.7.1
CVE-2026-73499 · published · modified · JSON