Etcd

Multiple vulnerabilities have been identified in etcd that could allow a remote attacker to bypass security controls or trigger a denial of service condition.

An authorization bypass vulnerability (GHSA-xg4h-6gfc-h4m8) in etcd's Watch API allows an authenticated user with READ permission on a single key to exploit the `clientv3.WithFromKey()` function, gaining unauthorized access to monitor and receive events for all keys lexicographically greater than or equal to their permitted key in clusters with authentication enabled.

A denial-of-service vulnerability in etcd's TLS listener allows a network attacker to exhaust server memory by spawning unbounded goroutines through multiple TCP connections without sending ClientHello messages, leading to loss of availability for etcd clusters and dependent services like Kubernetes.

The etcd gRPC client listener is affected by CVE-2026-59818, a vulnerability where it fails to properly enforce Certificate Revocation Lists (CRLs) when the `--client-crl-file` flag is used, potentially allowing clients with revoked certificates to bypass authentication and gain unauthorized access to etcd instances.