Detections
Analytics

SCA: security update for go.etcd.io/etcd/v3 (GHSA-q8m4-xhhv-38mg)

high Tenable Self-Hosted Container Security Plugin ID 439092

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42,
 3.5.28, and 3.6.9, unauthorized users may bypass authentication or authorization checks and call certain
 etcd functions in clusters that expose the gRPC API to untrusted or partially trusted clients. In
 unpatched etcd clusters with etcd auth enabled, unauthorized users are able to call MemberList and learn
 cluster topology, including member IDs and advertised endpoints; call Alarm, which can be abused for
 operational disruption or denial of service; use Lease APIs, interfering with TTL-based keys and lease
 ownership; and/or trigger compaction, permanently removing historical revisions and disrupting watch,
 audit, and recovery workflows. Kubernetes does not rely on etcd’s built-in authentication and
 authorization. Instead, the API server handles authentication and authorization itself, so typical
 Kubernetes deployments are not affected. Versions 3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading
 is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice.
 Restrict network access to etcd server ports so only trusted components can connect and/or require strong
 client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution.
 (CVE-2026-33413)

Solution

Update the go.etcd.io/etcd/v3 library and its related packages to version 3.4.42 or later.

See Also

https://github.com/advisories/GHSA-q8m4-xhhv-38mg

Plugin Details

Severity: High

ID: 439092

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 3/21/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.92

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-33413

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.8

Threat Score: 6.8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/20/2026

Vulnerability Publication Date: 3/20/2026

Reference Information

CVE: CVE-2026-33413

cwe: CWE-862