{"action":"Upgrade go.etcd.io/etcd to 3.4.44 or later.","affected":[{"fixed":"3.4.44","introduced":"0"}],"component":"go.etcd.io/etcd","cve_ids":["CVE-2026-44283"],"ecosystem":"Go","epss":0.00225,"exploited":false,"fixed_versions":["3.4.44"],"ghsa_id":"GHSA-x35m-3gp4-4fh5","id":"tcs_01M5KFRF9E8Y1VDKRE6743TJB3","modified_at":"2026-09-10T03:51:07.211759765Z","published_at":"2026-05-07T03:21:53Z","references":["https://osv.dev/vulnerability/GHSA-x35m-3gp4-4fh5","https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5","https://nvd.nist.gov/vuln/detail/CVE-2026-44283","https://github.com/etcd-io/etcd"],"severity":{"label":"unknown","score":0},"sources":[{"source":"osv","source_id":"GHSA-x35m-3gp4-4fh5#Go/go.etcd.io/etcd","url":"https://osv.dev/vulnerability/GHSA-x35m-3gp4-4fh5"}],"summary":"etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests"}