SB20260505100 - Multiple vulnerabilities in etcd

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260505100

SB20260505100 - Multiple vulnerabilities in etcd

Published: May 5, 2026

Security Bulletin ID SB20260505100
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-44283)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to access unauthorized data.

The vulnerability exists due to improper access control in transaction operations when processing Put requests with PrevKv enabled. A remote attacker can send a specially crafted transaction request to access unauthorized data.

Kubernetes deployments that rely on the API server for authentication and authorization are not affected.


2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to attach leases without authorization.

The vulnerability exists due to improper access control in transaction operations when processing Put requests with lease attachment enabled. A remote attacker can send a specially crafted transaction request to attach leases without authorization.

Kubernetes deployments that rely on the API server for authentication and authorization are not affected.


Remediation

Install update from vendor's website.

References