etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested transactions to bypass all key-level authorization. This allows any authenticated user with direct access to etcd to effectively ignore all key range restrictions, accessing the entire etcd data store. Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected. Versions 3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice. Restrict network access to etcd server ports so only trusted components can connect and require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution.

An update of the etcd package has been released.

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-33343 advisory.

  - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42,     3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested     transactions to bypass all key-level authorization. This allows any authenticated user with direct access     to etcd to effectively ignore all key range restrictions, accessing the entire etcd data store. Kubernetes     does not rely on etcd's built-in authentication and authorization. Instead, the API server handles     authentication and authorization itself, so typical Kubernetes deployments are not affected. Versions     3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading is not immediately possible, reduce exposure by     treating the affected RPCs as unauthenticated in practice. Restrict network access to etcd server ports so     only trusted components can connect and require strong client identity at the transport layer, such as     mTLS with tightly scoped client certificate distribution. (CVE-2026-33343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-33343 advisory.

  - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42,     3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested     transactions to bypass all key-level authorization. This allows any authenticated user with direct access     to etcd to effectively ignore all key range restrictions, accessing the entire etcd data store. Kubernetes     does not rely on etcd's built-in authentication and authorization. Instead, the API server handles     authentication and authorization itself, so typical Kubernetes deployments are not affected. Versions     3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading is not immediately possible, reduce exposure by     treating the affected RPCs as unauthenticated in practice. Restrict network access to etcd server ports so     only trusted components can connect and require strong client identity at the transport layer, such as     mTLS with tightly scoped client certificate distribution. (CVE-2026-33343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42,     3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested     transactions to bypass all key-level authorization. This allows any authenticated user with direct access     to etcd to effectively ignore all key range restrictions, accessing the entire etcd data store. Kubernetes     does not rely on etcd's built-in authentication and authorization. Instead, the API server handles     authentication and authorization itself, so typical Kubernetes deployments are not affected. Versions     3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading is not immediately possible, reduce exposure by     treating the affected RPCs as unauthenticated in practice. Restrict network access to etcd server ports so     only trusted components can connect and require strong client identity at the transport layer, such as     mTLS with tightly scoped client certificate distribution. (CVE-2026-33343)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42,
    3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested
    transactions to bypass all key-level authorization. This allows any authenticated user with direct access
    to etcd to effectively ignore all key range restrictions, accessing the entire etcd data store. Kubernetes
    does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles
    authentication and authorization itself, so typical Kubernetes deployments are not affected. Versions
    3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading is not immediately possible, reduce exposure by
    treating the affected RPCs as unauthenticated in practice. Restrict network access to etcd server ports so
    only trusted components can connect and require strong client identity at the transport layer, such as
    mTLS with tightly scoped client certificate distribution. (CVE-2026-33343)

ID	Name	Product	Family	Severity
313510	Photon OS 4.0: Etcd PHSA-2026-4.0-1012	Nessus	PhotonOS Local Security Checks	high
306492	Photon OS 5.0: Etcd PHSA-2026-5.0-0802	Nessus	PhotonOS Local Security Checks	high
304497	CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2026-33343)	Nessus	MarinerOS Local Security Checks	medium
304371	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-33343)	Nessus	Azure Linux Local Security Checks	medium
303895	Linux Distros Unpatched Vulnerability : CVE-2026-33343	Nessus	Misc.	medium
439089	SCA: security update for go.etcd.io/etcd/v3 (GHSA-rfx7-8w68-q57q)	Tenable Cloud Security	SCA Checks	medium
439089	SCA: security update for go.etcd.io/etcd/v3 (GHSA-rfx7-8w68-q57q)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-33343

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium