CVE-2026-66782

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

GO-2026-6114 Watch API authorization bypass in go.etcd.io/etcd/server/v3

In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey. The Watch RPC handler normalized open-ended range ends prior to authorization...

GO-2026-6107 Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3

In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking ma...

CVE-2026-73499

A flaw was found in etcd, a distributed key-value store. A user with READ permission on a single key can bypass authorization checks in the Watch gRPC API by using open-ended range requests. This allows them to receive watch events for keys beyond their authorized scope, leading to information...

BIT-ETCD-2026-73500 etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...

BIT-ETCD-2026-73499 etcd: Watch API authorization bypass via open-ended range requests

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

PT-2026-77226

Name of the Vulnerable Software and Affected Versions Submariner operator affected versions not specified Description A flaw in the Submariner operator allows a long-lived broker service account SA bearer token to be exposed within the Submariner Custom Resource CR specification. An attacker with...

GO-2026-5024 vulnerabilities

Vulnerabilities for packages: etcd-fips, k3s, knative-operator-fips, helm, gitlab-rails-ce, kube-conformance, etcd, kyverno, gitlab-workhorse-ce, gitlab-rails-ce-fips, containerd, kubeflow-katib, trino, upwind-agent...

GO-2026-4808 vulnerabilities

Vulnerabilities for packages: juicefs, etcd...

GO-2026-4806 vulnerabilities

Vulnerabilities for packages: juicefs, etcd...

GO-2021-0077 vulnerabilities

Vulnerabilities for packages: etcd-fips, etcd...

GO-2024-2529 vulnerabilities

Vulnerabilities for packages: etcd-fips, dgraph, etcd...

GO-2020-0005 vulnerabilities

Vulnerabilities for packages: etcd-fips, dgraph, etcd...

GO-2024-2530 vulnerabilities

Vulnerabilities for packages: etcd-fips, juicefs, dgraph, etcd...

GO-2024-2528 vulnerabilities

Vulnerabilities for packages: etcd-fips, dgraph, etcd...

GO-2026-5736 vulnerabilities

Vulnerabilities for packages: juicefs, multicluster-controlplane-fips, dapr, dapr-fips, kcp-fips, etcd, multicluster-controlplane, rancher-support-bundle-kit, milvus, kcp...

GO-2025-4116 vulnerabilities

Vulnerabilities for packages: etcd-fips, k3s, consul-k8s, gitlab-rails-ce, kube-conformance, etcd, vault, rke2-runtime-fips, cert-manager-fips, gitlab-rails-ce-fips, backup-restore-operator, falco-no-driver, terraform...

GO-2026-5025 vulnerabilities

Vulnerabilities for packages: prometheus-operator, ory-kratos, kube-conformance, gitlab-workhorse-ce-fips, crossplane-provider-aws-route53recoverycontrolconfig-fips, crossplane-provider-azure-streamanalytics, istio-fips, datadog-agent-fips, frankenphp-8.3, prometheus-mongodb-exporter,...

GO-2026-5016 vulnerabilities

Vulnerabilities for packages: redpanda-console, prometheus-operator, docker-cli-buildx-fips, kube-conformance, kubescape-server, gitlab-workhorse-ce-fips, terragrunt, datadog-agent-fips, frankenphp-8.3, prometheus-mongodb-exporter, elastic-agent-fips, external-secrets-operator,...

GO-2024-3250 vulnerabilities

Vulnerabilities for packages: octo-sts, atlantis, policy-controller-fips, kaniko-fips, tkn, git-sync-fips, chartmuseum, goreleaser, cosign, terraform, temporal, git-sync, kaniko, temporal-fips, vault, zarf, kubernetes, zot, minio-operator, ko, crossplane-provider-azure-managedidentity, kine,...