Improper access control in etcd - CVE-2026-33413
Published: May 5, 2026
Vulnerability identifier: #VU130102
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33413
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization checks and invoke restricted etcd API functions.
The vulnerability exists due to improper access control in the gRPC API layer when handling gRPC API requests from untrusted or partially trusted clients. A remote attacker can call MemberList, Alarm, Lease APIs, or trigger compaction to bypass authorization checks and invoke restricted etcd API functions.
The issue is exposed in clusters with etcd auth enabled that expose the gRPC API to untrusted or partially trusted clients.
Affected software
etcd
etcd (Red Hat package)
Red Hat OpenStack
etcd (Red Hat package)
Red Hat OpenStack
How to mitigate CVE-2026-33413
Install security update from vendor's website.
etcd - addressed in versions 3.4.42, 3.5.28, 3.6.9
etcd (Red Hat package) - update to 3.4.26-9.5.el9ost
Red Hat OpenStack - update to 17.1
etcd (Red Hat package) - update to 3.4.26-9.5.el9ost
Red Hat OpenStack - update to 17.1