CVE-2026-44283CWE-863

etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks

published May 14, 2026

CVSS v3.1
0.0
EPSS
0%
Percentile
18.8
In the wild
Unconfirmed
What it is

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.

The record
Technical detail
CVSS v3.1
0.0 · NONE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00274 · 18.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-14T17:01Z
EPSS history
Timeline
  • 14 MAY 17:01Z
    etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks
    cvelistv5