{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/etcd--3.6.0--3.6.14/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["etcd (\u003e= 3.7.0-alpha.0, \u003c 3.7.1)","etcd (\u003e= 3.6.0, \u003c 3.6.14)","etcd (\u003c 3.5.33)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","etcd","rbac","data-collection"],"_cs_type":"advisory","_cs_vendors":["etcd"],"content_html":"\u003cp\u003eA high-severity authorization bypass vulnerability, identified as GHSA-xg4h-6gfc-h4m8, has been discovered in etcd's Watch API, affecting versions prior to 3.5.33, versions 3.6.0 through 3.6.13, and versions 3.7.0-alpha.0 through 3.7.0. This flaw specifically impacts etcd clusters with authentication enabled and allows an authenticated user, even with READ permission limited to a single, exact key, to gain unauthorized access to a significant portion of the etcd keyspace. By leveraging the \u003ccode\u003eclientv3.WithFromKey()\u003c/code\u003e function in a Watch gRPC API request, attackers can monitor and receive events for all keys lexicographically greater than or equal to their permitted key, bypassing RBAC enforcement. This vulnerability grants unauthorized data collection capabilities to users who should have highly restricted access, posing a significant risk to data confidentiality and integrity within etcd deployments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker obtains valid authentication credentials for an etcd cluster where RBAC is enabled.\u003c/li\u003e\n\u003cli\u003eThe attacker's user account is granted READ permission on a single, specific key within etcd, for example, \u003ccode\u003e/config/app1/secret\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates a Watch gRPC API request to the etcd server using the \u003ccode\u003eclientv3.WithFromKey()\u003c/code\u003e option.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eclientv3.WithFromKey()\u003c/code\u003e option constructs an open-ended watch request, instructing etcd to send events for all keys lexicographically greater than or equal to \u003ccode\u003e/config/app1/secret\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to the authorization bypass vulnerability, etcd's RBAC enforcement for the Watch API fails to properly restrict this open-ended range request.\u003c/li\u003e\n\u003cli\u003eThe etcd server begins streaming watch events not only for the initially permitted key but also for all subsequent keys in the keyspace (e.g., \u003ccode\u003e/config/app1/user_data\u003c/code\u003e, \u003ccode\u003e/config/app2/settings\u003c/code\u003e, \u003ccode\u003e/production/data\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker receives unauthorized watch events, gaining access to potentially sensitive configuration, secrets, and data stored in the broader etcd keyspace.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of this authorization bypass allows an attacker with limited read permissions to gain unauthorized, broad access to an etcd cluster's keyspace. This can lead to the exposure of sensitive configuration data, secrets, or application-specific information that should otherwise be protected by RBAC. The vulnerability affects any etcd deployment running vulnerable versions with authentication enabled, potentially compromising the confidentiality of critical data. While specific victim counts are not available, any organization using etcd for distributed configuration or service discovery is at risk if they have not applied the patches, especially those with stringent RBAC policies expecting granular access control.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch etcd instances immediately to versions 3.7.1, 3.6.14, or 3.5.33 to resolve the authorization bypass vulnerability.\u003c/li\u003e\n\u003cli\u003eReview all existing READ grants within your etcd RBAC configuration, specifically auditing any user or role with permissions on single keys, as these can be leveraged via the Watch API to gain broader access.\u003c/li\u003e\n\u003cli\u003eRestrict network access to etcd's client (gRPC) port via firewall rules or network policies, limiting which hosts can communicate with etcd and reducing the attack surface.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T22:44:41Z","date_published":"2026-07-24T22:44:41Z","id":"https://feed.craftedsignal.io/briefs/2026-07-etcd-watch-api-auth-bypass/","summary":"An authorization bypass vulnerability (GHSA-xg4h-6gfc-h4m8) in etcd's Watch API allows an authenticated user with READ permission on a single key to exploit the `clientv3.WithFromKey()` function, gaining unauthorized access to monitor and receive events for all keys lexicographically greater than or equal to their permitted key in clusters with authentication enabled.","title":"etcd Watch API Authorization Bypass via Open-Ended Range Requests","url":"https://feed.craftedsignal.io/briefs/2026-07-etcd-watch-api-auth-bypass/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["etcd (\u003c 3.5.33)","etcd (\u003e= 3.6.0, \u003c 3.6.14)","etcd (\u003e= 3.7.0-alpha.0, \u003c 3.7.1)"],"_cs_severities":["medium"],"_cs_tags":["etcd","denial-of-service","kubernetes","TLS"],"_cs_type":"advisory","_cs_vendors":["etcd project"],"content_html":"\u003cp\u003eA critical denial-of-service vulnerability (GHSA-6vch-q96h-7gc3) exists in etcd's TLS listener, allowing a remote network attacker to render etcd clusters unavailable. This flaw, discovered and reported by VMware By Broadcom, affects etcd versions prior to 3.5.33, 3.6.0 through 3.6.13, and 3.7.0-alpha.0 through 3.7.0. The vulnerability stems from etcd's \u003ccode\u003etlsListener.acceptLoop\u003c/code\u003e component, which spawns an unbounded number of goroutines when handling incoming TCP connections that do not proceed with a TLS ClientHello message. Each uncompleted handshake consumes server memory indefinitely, leading to memory exhaustion and subsequent denial of service for the etcd process. This directly impacts the availability of etcd-backed services, most notably the control plane for Kubernetes deployments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA network attacker establishes numerous TCP connections to a vulnerable etcd TLS listener on the target server.\u003c/li\u003e\n\u003cli\u003eThe attacker intentionally refrains from sending the expected TLS ClientHello message after initial TCP connection establishment for each new connection.\u003c/li\u003e\n\u003cli\u003eFor every incoming TCP connection, the etcd server's \u003ccode\u003etlsListener.acceptLoop\u003c/code\u003e component spawns a dedicated goroutine to manage the TLS handshake.\u003c/li\u003e\n\u003cli\u003eEach spawned goroutine attempts to perform a TLS handshake and consequently enters a blocking state within \u003ccode\u003etls.Conn.Handshake()\u003c/code\u003e, waiting indefinitely for the absent ClientHello message.\u003c/li\u003e\n\u003cli\u003eThe etcd process's internal pending map tracks these blocked goroutines and their associated connection states, leading to an uncontrolled increase in entries.\u003c/li\u003e\n\u003cli\u003eAs the attacker maintains open, incomplete connections, the number of blocked goroutines and the size of the internal pending map grow without bound.\u003c/li\u003e\n\u003cli\u003eThis uncontrolled growth continuously consumes increasing amounts of memory within the etcd server process, eventually leading to memory exhaustion.\u003c/li\u003e\n\u003cli\u003eThe etcd server process crashes or becomes unresponsive, resulting in a denial of service for the etcd cluster and its dependent services, such as a Kubernetes control plane.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to a complete loss of availability for the targeted etcd cluster due to memory exhaustion and subsequent process crashes. Organizations using affected etcd versions, particularly those relying on etcd as the backend for their Kubernetes control planes, are at risk. A denial of service for etcd directly impacts the operational status and management capabilities of Kubernetes, potentially rendering clusters inoperable until the etcd instance is restored or patched. There are no specific victim counts or sectors mentioned, but any organization using etcd is potentially vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade etcd to a patched version immediately to remediate the vulnerability (etcd 3.7.1, 3.6.14, or 3.5.33).\u003c/li\u003e\n\u003cli\u003eRestrict network access to etcd's client (gRPC) port for vulnerable versions using firewall rules or network policy to limit potential attackers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T22:43:21Z","date_published":"2026-07-24T22:43:21Z","id":"https://feed.craftedsignal.io/briefs/2026-07-etcd-tls-dos/","summary":"A denial-of-service vulnerability in etcd's TLS listener allows a network attacker to exhaust server memory by spawning unbounded goroutines through multiple TCP connections without sending ClientHello messages, leading to loss of availability for etcd clusters and dependent services like Kubernetes.","title":"etcd TLS Listener Denial of Service Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-etcd-tls-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Etcd (\u003e= 3.6.0, \u003c 3.6.14)","version":"https://jsonfeed.org/version/1.1"}