etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

An update of the etcd package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33,
    3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with
    clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to
    the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten
    before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing
    the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and
    the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33,
    3.6.14, and 3.7.1. (CVE-2026-73499)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33,     3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with     clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to     the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten     before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing     the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and     the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33,     3.6.14, and 3.7.1. (CVE-2026-73499)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375618	Photon OS 5.0: Etcd PHSA-2026-5.0-92-0975	Nessus	PhotonOS Local Security Checks	Local	high
374984	Photon OS 5.0: Etcd PHSA-2026-5.0-91-0975	Nessus	PhotonOS Local Security Checks	Local	high
459560	Echo: go.etcd.io/etcd/server/v3: security update to 3.5.33	Tenable Cloud Security	Echo Local Security Checks	Local	high
459560	Echo: go.etcd.io/etcd/server/v3: security update to 3.5.33	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
445913	SCA: security update for go.etcd.io/etcd/v3 (GHSA-xg4h-6gfc-h4m8)	Tenable Cloud Security	SCA Checks	Local	high
445913	SCA: security update for go.etcd.io/etcd/v3 (GHSA-xg4h-6gfc-h4m8)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
335146	Linux Distros Unpatched Vulnerability : CVE-2026-73499	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-73499

high

Tenable Plugins

high

high

high

high

high

high

high