GHSA-X35M-3GP4-4FH5 etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

Impact What kind of vulnerability is it? Who is impacted? A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may b...

etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

Impact What kind of vulnerability is it? Who is impacted? A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may b...

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Summary There is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. Details Argo CD masks Secret...

Argo CD 信息泄露漏洞

Argo CD is an open-source tool developed by Argo for Kubernetes, designed for declarative GitOps continuous delivery. Versions of Argo CD prior to 3.2.11 and 3.3.0–3.3.9 contained a vulnerability related to information leakage. This vulnerability stemmed from a lack of authorization and data...

Important Photon OS Security Update - PHSA-2026-4.0-1012

Updates of 'etcd', 'vim' packages of Photon OS have been released...

RHCOS 3 : kubernetes (RHSA-2015:1945)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1945 advisory. - Kubernetes: Missing name validation allows path traversal in etcd CVE-2015-5305 Note that Nessus has not tested for this issue but has...

PT-2026-38402

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.4.44 etcd versions prior to 3.5.30 etcd versions prior to 3.6.11 Description etcd is a distributed key-value store for distributed system data. A flaw allows authenticated users without sufficient read or lease-related...

Photon OS 5.0: Etcd PHSA-2026-5.0-0802

An update of the etcd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0802. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-33413 affecting package etcd for versions less than 3.5.28-1

CVE-2026-33413 affecting package etcd for versions less than 3.5.28-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-33343 affecting package etcd for versions less than 3.5.28-1

CVE-2026-33343 affecting package etcd for versions less than 3.5.28-1. An upgraded version of the package is available that resolves this issue...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, delve, kaf, sftpgo, argo-events, dapr, falco-exporter, kube-vip, crossplane-provider-azure-managedidentity, helm, cert-manager-csi-driver, cloud-provider-azure, apisix-ingress-controller, k8ssandra-operator, vault-secrets-webhook,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: kuma, cloud-provider-vsphere, melange, grafana-alloy, sftpgo, argo-events, dapr, zarf, crossplane-provider-azure-managedidentity, cert-manager-webhook-pdns, tekton-pipelines, velero, node-feature-discovery, cloud-provider-azure, apisix-ingress-controller,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: kyverno-fips, restic-fips, volsync-fips, trivy, modelmesh-runtime-adapter, gitlab-cng, crossplane-provider-aws-vpc-fips, kube-state-metrics, k9s-fips, keda, crossplane-provider-aws-guardduty-fips, google-osconfig-agent, crossplane-provider-aws-elasticache-fips,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: kyverno-fips, restic-fips, volsync-fips, trivy, modelmesh-runtime-adapter, gitlab-cng, crossplane-provider-aws-vpc-fips, kube-state-metrics, k9s-fips, keda, crossplane-provider-aws-guardduty-fips, google-osconfig-agent, crossplane-provider-aws-elasticache-fips,...

GO-2026-4808 Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd

Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd...

GO-2026-4806 Authorization bypasses in multiple APIs in go.etcd.io/etcd

Authorization bypasses in multiple APIs in go.etcd.io/etcd...

CVE-2026-33413 affecting package etcd for versions less than 3.5.28-1

CVE-2026-33413 affecting package etcd for versions less than 3.5.28-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-33343 affecting package etcd for versions less than 3.5.28-1

CVE-2026-33343 affecting package etcd for versions less than 3.5.28-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-33817

Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt...

Critical Photon OS Security Update - PHSA-2026-5.0-0802

Updates of 'rubygem-activesupport', 'etcd', 'glibc', 'nghttp2', 'strongswan', 'python3-Pygments', 'sqlite', 'python3-requests', 'python3-pyOpenSSL', 'libpng', 'python3' packages of Photon OS have been released...