Etcd (>= 3.7.0-Alpha.0, < 3.7.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/etcd--3.7.0-alpha.0--3.7.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 24 Jul 2026 22:44:41 +0000etcd Watch API Authorization Bypass via Open-Ended Range Requestshttps://feed.craftedsignal.io/briefs/2026-07-etcd-watch-api-auth-bypass/Fri, 24 Jul 2026 22:44:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-etcd-watch-api-auth-bypass/An authorization bypass vulnerability (GHSA-xg4h-6gfc-h4m8) in etcd's Watch API allows an authenticated user with READ permission on a single key to exploit the `clientv3.WithFromKey()` function, gaining unauthorized access to monitor and receive events for all keys lexicographically greater than or equal to their permitted key in clusters with authentication enabled.A high-severity authorization bypass vulnerability, identified as GHSA-xg4h-6gfc-h4m8, has been discovered in etcd's Watch API, affecting versions prior to 3.5.33, versions 3.6.0 through 3.6.13, and versions 3.7.0-alpha.0 through 3.7.0. This flaw specifically impacts etcd clusters with authentication enabled and allows an authenticated user, even with READ permission limited to a single, exact key, to gain unauthorized access to a significant portion of the etcd keyspace. By leveraging the clientv3.WithFromKey() function in a Watch gRPC API request, attackers can monitor and receive events for all keys lexicographically greater than or equal to their permitted key, bypassing RBAC enforcement. This vulnerability grants unauthorized data collection capabilities to users who should have highly restricted access, posing a significant risk to data confidentiality and integrity within etcd deployments.

Attack Chain

  1. An attacker obtains valid authentication credentials for an etcd cluster where RBAC is enabled.
  2. The attacker's user account is granted READ permission on a single, specific key within etcd, for example, /config/app1/secret.
  3. The attacker initiates a Watch gRPC API request to the etcd server using the clientv3.WithFromKey() option.
  4. The clientv3.WithFromKey() option constructs an open-ended watch request, instructing etcd to send events for all keys lexicographically greater than or equal to /config/app1/secret.
  5. Due to the authorization bypass vulnerability, etcd's RBAC enforcement for the Watch API fails to properly restrict this open-ended range request.
  6. The etcd server begins streaming watch events not only for the initially permitted key but also for all subsequent keys in the keyspace (e.g., /config/app1/user_data, /config/app2/settings, /production/data).
  7. The attacker receives unauthorized watch events, gaining access to potentially sensitive configuration, secrets, and data stored in the broader etcd keyspace.

Impact

The successful exploitation of this authorization bypass allows an attacker with limited read permissions to gain unauthorized, broad access to an etcd cluster's keyspace. This can lead to the exposure of sensitive configuration data, secrets, or application-specific information that should otherwise be protected by RBAC. The vulnerability affects any etcd deployment running vulnerable versions with authentication enabled, potentially compromising the confidentiality of critical data. While specific victim counts are not available, any organization using etcd for distributed configuration or service discovery is at risk if they have not applied the patches, especially those with stringent RBAC policies expecting granular access control.

Recommendation

  • Patch etcd instances immediately to versions 3.7.1, 3.6.14, or 3.5.33 to resolve the authorization bypass vulnerability.
  • Review all existing READ grants within your etcd RBAC configuration, specifically auditing any user or role with permissions on single keys, as these can be leveraged via the Watch API to gain broader access.
  • Restrict network access to etcd's client (gRPC) port via firewall rules or network policies, limiting which hosts can communicate with etcd and reducing the attack surface.
]]>highadvisoryauthorization-bypassetcdrbacdata-collectionetcd TLS Listener Denial of Service Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-07-etcd-tls-dos/Fri, 24 Jul 2026 22:43:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-etcd-tls-dos/A denial-of-service vulnerability in etcd's TLS listener allows a network attacker to exhaust server memory by spawning unbounded goroutines through multiple TCP connections without sending ClientHello messages, leading to loss of availability for etcd clusters and dependent services like Kubernetes.A critical denial-of-service vulnerability (GHSA-6vch-q96h-7gc3) exists in etcd's TLS listener, allowing a remote network attacker to render etcd clusters unavailable. This flaw, discovered and reported by VMware By Broadcom, affects etcd versions prior to 3.5.33, 3.6.0 through 3.6.13, and 3.7.0-alpha.0 through 3.7.0. The vulnerability stems from etcd's tlsListener.acceptLoop component, which spawns an unbounded number of goroutines when handling incoming TCP connections that do not proceed with a TLS ClientHello message. Each uncompleted handshake consumes server memory indefinitely, leading to memory exhaustion and subsequent denial of service for the etcd process. This directly impacts the availability of etcd-backed services, most notably the control plane for Kubernetes deployments.

Attack Chain

  1. A network attacker establishes numerous TCP connections to a vulnerable etcd TLS listener on the target server.
  2. The attacker intentionally refrains from sending the expected TLS ClientHello message after initial TCP connection establishment for each new connection.
  3. For every incoming TCP connection, the etcd server's tlsListener.acceptLoop component spawns a dedicated goroutine to manage the TLS handshake.
  4. Each spawned goroutine attempts to perform a TLS handshake and consequently enters a blocking state within tls.Conn.Handshake(), waiting indefinitely for the absent ClientHello message.
  5. The etcd process's internal pending map tracks these blocked goroutines and their associated connection states, leading to an uncontrolled increase in entries.
  6. As the attacker maintains open, incomplete connections, the number of blocked goroutines and the size of the internal pending map grow without bound.
  7. This uncontrolled growth continuously consumes increasing amounts of memory within the etcd server process, eventually leading to memory exhaustion.
  8. The etcd server process crashes or becomes unresponsive, resulting in a denial of service for the etcd cluster and its dependent services, such as a Kubernetes control plane.

Impact

Successful exploitation of this vulnerability leads to a complete loss of availability for the targeted etcd cluster due to memory exhaustion and subsequent process crashes. Organizations using affected etcd versions, particularly those relying on etcd as the backend for their Kubernetes control planes, are at risk. A denial of service for etcd directly impacts the operational status and management capabilities of Kubernetes, potentially rendering clusters inoperable until the etcd instance is restored or patched. There are no specific victim counts or sectors mentioned, but any organization using etcd is potentially vulnerable.

Recommendation

  • Upgrade etcd to a patched version immediately to remediate the vulnerability (etcd 3.7.1, 3.6.14, or 3.5.33).
  • Restrict network access to etcd's client (gRPC) port for vulnerable versions using firewall rules or network policy to limit potential attackers.
]]>mediumadvisoryetcddenial-of-servicekubernetesTLS