EUVD-2026-51311

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema and GetDefaultDatastoreUsername, allowing distinct...

CVE-2026-56852 affecting package etcd for versions less than 3.5.33-1

CVE-2026-56852 affecting package etcd for versions less than 3.5.33-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-59818 affecting package etcd for versions less than 3.5.33-1

CVE-2026-59818 affecting package etcd for versions less than 3.5.33-1. An upgraded version of the package is available that resolves this issue...

GHSA-6VCH-Q96H-7GC3 etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

Impact What kind of vulnerability is it? Who is impacted? A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake, and each is...

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

Impact What kind of vulnerability is it? Who is impacted? A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake, and each is...

etcd: Watch API authorization bypass via open-ended range requests

Impact What kind of vulnerability is it? Who is impacted? A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey an open-ended, "from this key to the end of the keyspace" watch to receive watch events for every key lexicographically greater than...

GHSA-XG4H-6GFC-H4M8 etcd: Watch API authorization bypass via open-ended range requests

Impact What kind of vulnerability is it? Who is impacted? A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey an open-ended, "from this key to the end of the keyspace" watch to receive watch events for every key lexicographically greater than...

GO-2026-5736 Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server

Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server...

etcd: etcd: Authentication bypass due to improper Certificate Revocation List enforcement on gRPC listener

A flaw was found in etcd, a distributed key-value store. When etcd is configured to use separate listeners for HTTP and gRPC client endpoints, the Certificate Revocation List CRL is not properly enforced on the gRPC listener. This oversight allows a client with a revoked certificate to successful...

etcd: etcd: Denial of Service via unbounded TLS handshake goroutines

A flaw was found in etcd, a distributed key-value store. A remote attacker can exploit this by opening numerous TCP connections to an etcd TLS listener without completing the TLS handshake. This action causes the tlsListener.acceptLoop to spawn an unbounded number of goroutines, which consume...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: etcd: etcd-3.7.1-0.1.hum1 aarch64, x8664 etcd-3.7.1-0.1.hum1.src src...

etcd: etcd: Authenticated user can bypass RBAC for unauthorized data access

A flaw was found in etcd, a distributed key-value store. An authenticated user, without sufficient read or lease-related permissions, could bypass Role-Based Access Control RBAC authorization checks. This bypass occurs during transaction operations involving PrevKv or lease attachment in Put...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: etcd: etcd-3.7.0-0.3.hum1 aarch64, x8664 etcd-3.7.0-0.3.hum1.src src Security Fixes: etcd: CVE-2026-56852...

AZL-93174 CVE-2026-56852 affecting package etcd for versions less than 3.5.33-1

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

GO-2026-5973 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

Path Traversal

github.com/k3s-io/k3s is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths in the etcd snapshot decompression functionality when restoring compressed ZIP-based snapshots, which allows an attacker to craft archive entries with malicious file names that wri...

EUVD-2026-39512

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression...

GHSA-JXR7-MQHW-9P98 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names e.g., ../../../../etc/password can be written to arbitrary locations on the filesystem when an administrator restores the archive a...

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names e.g., ../../../../etc/password can be written to arbitrary locations on the filesystem when an administrator restores the archive a...

BIT-ETCD-2026-59818 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the...