CVE-2026-33343

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33343", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T22:15:11.813Z", "datePublished": "2026-03-26T13:23:48.247Z", "dateUpdated": "2026-03-26T18:25:09.851Z"}, "containers": {"cna": {"title": "etcd: Nested etcd transactions bypass RBAC authorization checks", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q"}], "affected": [{"vendor": "etcd-io", "product": "etcd", "versions": [{"version": ">= 3.5.0-alpha.0, < 3.5.28", "status": "affected"}, {"version": ">= 3.6.0-alpha.0, < 3.6.9", "status": "affected"}, {"version": "< 3.4.42", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T13:23:48.247Z"}, "descriptions": [{"lang": "en", "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested transactions to bypass all key-level authorization. This allows any authenticated user with direct access to etcd to effectively ignore all key range restrictions, accessing the entire etcd data store. Kubernetes does not rely on etcd\u2019s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected. Versions 3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice. Restrict network access to etcd server ports so only trusted components can connect and require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution."}], "source": {"advisory": "GHSA-rfx7-8w68-q57q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T18:13:49.545838Z", "id": "CVE-2026-33343", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:25:09.851Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33343", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T18:13:49.545838Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:14:37.624Z"}}], "cna": {"title": "etcd: Nested etcd transactions bypass RBAC authorization checks", "source": {"advisory": "GHSA-rfx7-8w68-q57q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 0, "attackVector": "NETWORK", "baseSeverity": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "etcd-io", "product": "etcd", "versions": [{"status": "affected", "version": ">= 3.5.0-alpha.0, < 3.5.28"}, {"status": "affected", "version": ">= 3.6.0-alpha.0, < 3.6.9"}, {"status": "affected", "version": "< 3.4.42"}]}], "references": [{"url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q", "name": "https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested transactions to bypass all key-level authorization. This allows any authenticated user with direct access to etcd to effectively ignore all key range restrictions, accessing the entire etcd data store. Kubernetes does not rely on etcd\u2019s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected. Versions 3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice. Restrict network access to etcd server ports so only trusted components can connect and require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T13:23:48.247Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33343", "state": "PUBLISHED", "dateUpdated": "2026-03-26T18:25:09.851Z", "dateReserved": "2026-03-18T22:15:11.813Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T13:23:48.247Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "etcd", "vendor": "etcd-io", "versions": [{"status": "affected", "version": ">= 3.5.0-alpha.0, < 3.5.28"}, {"status": "affected", "version": ">= 3.6.0-alpha.0, < 3.6.9"}, {"status": "affected", "version": "< 3.4.42"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*", "matchCriteriaId": "F9D28F29-7668-485E-BE8A-7D74EECA0C86", "versionEndExcluding": "3.4.42", "vulnerable": true}, {"criteria": "cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*", "matchCriteriaId": "5C785A0D-9833-40E8-9BB5-DE51033FE744", "versionEndExcluding": "3.5.28", "versionStartIncluding": "3.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5676998-E142-4BF3-B2CC-9AA1F9AC1946", "versionEndExcluding": "3.6.9", "versionStartIncluding": "3.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested transactions to bypass all key-level authorization. This allows any authenticated user with direct access to etcd to effectively ignore all key range restrictions, accessing the entire etcd data store. Kubernetes does not rely on etcd\u2019s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected. Versions 3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice. Restrict network access to etcd server ports so only trusted components can connect and require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution."}, {"lang": "es", "value": "etcd es un almac\u00e9n distribuido de clave-valor para los datos de un sistema distribuido. Antes de las versiones 3.4.42, 3.5.28 y 3.6.9, un usuario autenticado con permisos RBAC restringidos en rangos de claves puede usar transacciones anidadas para eludir toda la autorizaci\u00f3n a nivel de clave. Esto permite a cualquier usuario autenticado con acceso directo a etcd ignorar efectivamente todas las restricciones de rango de claves, accediendo a todo el almac\u00e9n de datos de etcd. Kubernetes no depende de la autenticaci\u00f3n y autorizaci\u00f3n integradas de etcd. En su lugar, el servidor API maneja la autenticaci\u00f3n y autorizaci\u00f3n por s\u00ed mismo, por lo que las implementaciones t\u00edpicas de Kubernetes no se ven afectadas. Las versiones 3.4.42, 3.5.28 y 3.6.9 contienen un parche. Si la actualizaci\u00f3n no es posible de inmediato, reduzca la exposici\u00f3n tratando los RPC afectados como no autenticados en la pr\u00e1ctica. Restrinja el acceso de red a los puertos del servidor etcd para que solo los componentes de confianza puedan conectarse y requiera una identidad de cliente fuerte en la capa de transporte, como mTLS con distribuci\u00f3n de certificados de cliente de alcance limitado."}], "id": "CVE-2026-33343", "lastModified": "2026-06-17T10:37:20.833", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0.0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 0.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33343", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T18:13:49.545838Z", "version": "2.0.3"}}]}, "published": "2026-03-26T14:16:13.137", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "etcd: etcd: Authorization bypass allows information disclosure via nested transactions", "id": "2451727", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451727"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw was found in etcd, a distributed key-value store. An authenticated user with Role-Based Access Control (RBAC) restricted permissions on key ranges can exploit this flaw by using nested transactions. This bypasses all key-level authorization, allowing the user to access the entire etcd data store. This can lead to significant information disclosure."], "mitigation": {"lang": "en:us", "value": "To reduce exposure, restrict network access to etcd server ports, ensuring only trusted components can connect. Additionally, implement strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution. This limits direct access to the etcd data store, which is a prerequisite for exploiting this vulnerability. If etcd is configured to reload, a service restart may be required for these changes to take effect."}, "name": "CVE-2026-33343", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "etcd", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "etcd", "product_name": "Red Hat OpenStack Platform 17.1"}], "public_date": "2026-03-26T13:23:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33343\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33343\nhttps://github.com/etcd-io/etcd/security/advisories/GHSA-rfx7-8w68-q57q"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0-alpha.0,3.5.28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.6.0-alpha.0,3.6.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.4.42)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "etcd", "source": "cna", "vendor": "etcd-io"}, "product": "etcd", "vendor": "etcd"}], "analysis": {"en": {"generated_at": "2026-03-27T13:27:26.037944+00:00", "value": {"mitigation_remediation": ["Upgrade etcd to at least version 3.4.42, 3.5.28, or 3.6.9 where the issue is fixed.", "If an upgrade cannot be performed immediately, treat the affected etcd RPCs as unauthenticated and restrict their usage in practice.", "Restrict network access to etcd server ports so that only trusted components can connect to the server.", "Enforce strong client identity at the transport layer, such as mTLS with tightly scoped client certificates.", "Verify that your Kubernetes deployment does not rely on etcd\u2019s built\u2011in authentication, or audit your environment for direct etcd access.", "Monitor logs for unusual etcd transaction activity to detect potential abuse."], "summary": {"action": "Apply Patch", "impact": "Unauthorized access to entire etcd data store via RBAC bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability is present in etcd\u2011io's etcd server versions before 3.4.42, 3.5.28, and 3.6.9. Deployment environments that interact directly with etcd using these versions and rely on etcd\u2019s built\u2011in RBAC are affected. Typical Kubernetes installations, which use the API server for authentication and authorization, are not impacted unless they expose etcd directly to clients.", "description_and_impact": "The flaw allows an authenticated user with limited RBAC permissions to nest etcd transactions and bypass all key\u2011level authorization checks. By crafting a sequence of transactions, the attacker can retrieve any key in the store, effectively ignoring the defined access restrictions. This results in full disclosure of the etcd data, yielding confidentiality loss and potential system compromise.", "risk_and_exploitability": "The issue is scored with a high exploitation potential: any authenticated etcd client can exploit it without additional privileges. The EPSS score is not available and the vulnerability is not listed in KEV, but the practical risk remains high because the attack surface is the etcd RPC interface. If an attacker obtains valid credentials or compromises a user account that can communicate with etcd, they can perform the nested transaction trick to leak all data. Network exposure to the etcd server further increases exploitability, so limiting access and hardening the transport layer are crucial."}}}}, "created": "2026-03-27T08:34:31.356906+00:00", "updated": "2026-03-27T15:47:34.634377+00:00", "vendors": ["etcd", "etcd$PRODUCT$etcd"]}