CVE-2026-73499

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73499", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T19:00:33.736Z", "datePublished": "2026-08-12T21:20:31.888Z", "dateUpdated": "2026-08-14T22:19:59.624Z"}, "containers": {"cna": {"title": "etcd: Watch API authorization bypass via open-ended range requests", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8"}, {"name": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41", "tags": ["x_refsource_MISC"], "url": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41"}, {"name": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed", "tags": ["x_refsource_MISC"], "url": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed"}, {"name": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae", "tags": ["x_refsource_MISC"], "url": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae"}, {"name": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7", "tags": ["x_refsource_MISC"], "url": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7"}, {"name": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33", "tags": ["x_refsource_MISC"], "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33"}, {"name": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14"}, {"name": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1"}], "affected": [{"vendor": "etcd-io", "product": "etcd", "versions": [{"version": "< 3.5.33", "status": "affected"}, {"version": ">= 3.6.0, < 3.6.14", "status": "affected"}, {"version": ">= 3.7.0-alpha.0, < 3.7.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T21:20:31.888Z"}, "descriptions": [{"lang": "en", "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1."}], "source": {"advisory": "GHSA-xg4h-6gfc-h4m8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T22:19:48.980697Z", "id": "CVE-2026-73499", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T22:19:59.624Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73499", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T22:19:48.980697Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T22:19:54.407Z"}}], "cna": {"title": "etcd: Watch API authorization bypass via open-ended range requests", "source": {"advisory": "GHSA-xg4h-6gfc-h4m8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "etcd-io", "product": "etcd", "versions": [{"status": "affected", "version": "< 3.5.33"}, {"status": "affected", "version": ">= 3.6.0, < 3.6.14"}, {"status": "affected", "version": ">= 3.7.0-alpha.0, < 3.7.1"}]}], "references": [{"url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8", "name": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41", "name": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed", "name": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae", "name": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7", "name": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33", "name": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14", "name": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1", "name": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T21:20:31.888Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73499", "state": "PUBLISHED", "dateUpdated": "2026-08-14T22:19:59.624Z", "dateReserved": "2026-08-12T19:00:33.736Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-12T21:20:31.888Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "etcd", "vendor": "etcd-io", "versions": [{"status": "affected", "version": "< 3.5.33"}, {"status": "affected", "version": ">= 3.6.0, < 3.6.14"}, {"status": "affected", "version": ">= 3.7.0-alpha.0, < 3.7.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1."}, {"lang": "es", "value": "etcd es un almac\u00e9n distribuido de clave-valor para los datos de un sistema distribuido. Antes de las versiones 3.5.33, 3.6.14 y 3.7.1, un usuario al que se le concedi\u00f3 permiso de LECTURA en una \u00fanica clave exacta puede usar la API gRPC de Watch con clientv3.WithFromKey() para recibir eventos de observaci\u00f3n para cada clave lexicogr\u00e1ficamente mayor o igual que la clave permitida. En server/etcdserver/api/v3rpc/watch.go, el centinela RangeEnd de rango abierto se reescribe antes de la verificaci\u00f3n de permisos RBAC en la funci\u00f3n isRangeOpPermitted de server/auth/range_perm_cache.go, lo que hace que la solicitud se trate como una observaci\u00f3n de clave exacta. Las solicitudes de Range/Get y DeleteRange no se ven afectadas, y el problema afecta solo a los cl\u00fasteres con la autenticaci\u00f3n habilitada. Este problema se corrige en las versiones 3.5.33, 3.6.14 y 3.7.1."}], "id": "CVE-2026-73499", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73499", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T22:19:48.980697Z", "version": "2.0.3"}}]}, "published": "2026-08-12T22:17:17.130", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41"}, {"source": "security-advisories@github.com", "url": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed"}, {"source": "security-advisories@github.com", "url": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae"}, {"source": "security-advisories@github.com", "url": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7"}, {"source": "security-advisories@github.com", "url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33"}, {"source": "security-advisories@github.com", "url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14"}, {"source": "security-advisories@github.com", "url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "go.etcd.io/etcd: etcd: Information disclosure via Watch API authorization bypass", "id": "2515005", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515005"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-551", "details": ["A flaw was found in etcd, a distributed key-value store. A user with READ permission on a single key can bypass authorization checks in the Watch gRPC API by using open-ended range requests. This allows them to receive watch events for keys beyond their authorized scope, leading to information disclosure. This issue affects clusters with authentication enabled."], "mitigation": {"lang": "en:us", "value": "If etcd authentication is not required for the deployment, this vulnerability does not apply. For clusters with authentication enabled, restrict network-level access to the etcd gRPC API to trusted clients only, and audit user permissions to ensure the principle of least privilege."}, "name": "CVE-2026-73499", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Out of support scope", "package_name": "rhacm2/observatorium-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform/platform-operator-bundle", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Not affected", "package_name": "rhceph/snmp-notifier-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Not affected", "package_name": "rhceph/rhceph-promtail-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Not affected", "package_name": "rhceph/snmp-notifier-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Not affected", "package_name": "rhceph/snmp-notifier-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Not affected", "package_name": "rhceph/snmp-notifier-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Not affected", "package_name": "rhceph/snmp-notifier-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "etcd", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/oc-mirror-plugin-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/ose-baremetal-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/ose-clusterresourceoverride-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-etcd", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-etcd-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Fix deferred", "package_name": "openshift-gitops-1/argocd-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Fix deferred", "package_name": "openshift-gitops-1/argocd-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "etcd", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-etcd", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "etcd", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rhoso-operators/openstack-operator-bundle", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-08-12T21:20:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73499\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73499\nhttps://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41\nhttps://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed\nhttps://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae\nhttps://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7\nhttps://github.com/etcd-io/etcd/releases/tag/v3.5.33\nhttps://github.com/etcd-io/etcd/releases/tag/v3.6.14\nhttps://github.com/etcd-io/etcd/releases/tag/v3.7.1\nhttps://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8"], "statement": "A flaw was found in etcd's Watch gRPC API. A user with READ permission on a single key can use open-ended range requests to bypass RBAC authorization and receive watch events for keys beyond their authorized scope, leading to information disclosure. This issue only affects etcd clusters with authentication enabled.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.5.33)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.6.0,3.6.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.7.0-alpha.0,3.7.1)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "etcd", "source": "cna", "vendor": "etcd-io"}, "product": "etcd", "vendor": "etcd"}], "created": "2026-08-13T02:15:02.664678+00:00", "updated": "2026-08-22T10:30:17.485379+00:00", "vendors": ["etcd", "etcd$PRODUCT$etcd"], "weaknesses": ["CWE-551", "CWE-863"]}