high 8.8

CVE-2026-33413 json

etcd: Authorization bypasses in multiple APIs

published 2026-03-20 7 mo ago modified 2026-09-10 1 mo ago also BIT-etcd-2026-33413 , EUVD-2026-16191 , GHSA-q8m4-xhhv-38mg , GO-2026-4806

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits: 0; none known

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, unauthorized users may bypass authentication or authorization checks and call certain etcd functions in clusters that expose the gRPC API to untrusted or partially trusted clients. In unpatched etcd clusters with etcd auth enabled, unauthorized users are able to call MemberList and learn cluster topology, including member IDs and advertised endpoints; call Alarm, which can be abused for operational disruption or denial of service; use Lease APIs, interfering with TTL-based keys and lease ownership; and/or trigger compaction, permanently removing historical revisions and disrupting watch, audit, and recovery workflows. Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected. Versions 3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice. Restrict network access to etcd server ports so only trusted components can connect and/or require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution.

Patch / fix

fixed in 3 distros 5

go go.etcd.io/etcd/v3 3.4.42, 3.5.28, 3.6.9
bitnami etcd 3.4.42, 3.5.28, 3.6.9
etcd etcd 3.4.42, 3.5.28, 3.6.9

debian red hat opensuse alpine azure linux

etcd Debian 14 3.5.16-11

debian advisories DEBIAN-CVE-2026-33413

etcd openstack 16.2 3.3.23-22.el8ost
erlang openstack 16.2 23.3.4.18-2.el8ost
erlang-ssl openstack 16.2 23.3.4.18-2.el8ost
erlang-asn1 openstack 16.2 23.3.4.18-2.el8ost
erlang-erts openstack 16.2 23.3.4.18-2.el8ost
erlang-hipe openstack 16.2 23.3.4.18-2.el8ost
erlang-sasl openstack 16.2 23.3.4.18-2.el8ost
erlang-snmp openstack 16.2 23.3.4.18-2.el8ost

red hat advisories RHSA-2026:54757 RHSA-2026:28047

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
flannel openSUSE Tumbleweed 0.28.4-1.1

opensuse advisories openSUSE-SU-2026:21483-1 openSUSE-SU-2026:10562-1

etcd Alpine 3.24, Alpine 3.23 3.6.10-r0

alpine advisories ALPINE-CVE-2026-33413

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

etcd Azure Linux 3.0 3.5.28-1

azure linux advisories AZL-80957

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-33413 updated 2026-11-02 cvss 7.7

etcd: etcd: Authorization bypass allows information disclosure and denial of service

Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-rhel8-operator Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
affected: workaround, no fix available
Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779579439
fixed: vendor fix RHSA-2026:22347
Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1778867753
fixed: vendor fix RHSA-2026:21769
Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1780167118
fixed: vendor fix RHSA-2026:23345
Red Hat OpenStack Platform 16.2 etcd 3.3.23-22.el8ost
fixed: vendor fix RHSA-2026:54757
Red Hat OpenStack Platform 17.1 etcd 3.4.26-9.5.el9ost
fixed: vendor fix RHSA-2026:28047
Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779838819, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779839447, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779887217, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779891163, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779147132 Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779828691, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779828813, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779828536, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779837290, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779835152 Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1780320809, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1780321673, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779839087, multicluster-globalhub/multicluster-globalhub-operator-bundle 1780370487, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779839762
not affected: vulnerable code not present
Red Hat Ansible Automation Platform 2 ansible-automation-platform/platform-operator-bundle
not affected: component not present

show 1 more

Red Hat OpenShift Container Platform 4 openshift4/ose-etcd-rhel9, openshift4/oc-mirror-plugin-rhel9, openshift4/ose-baremetal-rhel9-operator Red Hat OpenStack Platform 16.2 erlang 23.3.4.18-2.el8ost, python-pyasn1 0.4.6-4.el8ost, erlang-ssl 23.3.4.18-2.el8ost, python3-pyasn1 0.4.6-4.el8ost, erlang-asn1 23.3.4.18-2.el8ost, erlang-erts 23.3.4.18-2.el8ost, +80 more Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundle
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 7 mo ago (2026-03-26)

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CNA	4.0	8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	go.etcd.io/etcd/v3	>=3.6.0-alpha.0, <3.6.9 >=3.5.0-alpha.0, <3.5.28 <3.4.42	3.6.9 3.5.28 3.4.42
go	go.etcd.io/etcd	<=3.3.27 all versions	no fix listed
bitnami	etcd	<3.4.42 >=3.5.0, <3.5.28 >=3.6.0, <3.6.9	3.4.42 3.5.28 3.6.9

Affected products

etcd-io etcd

Classification

Weakness

CWE-862 Missing Authorization

References

github.com /etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg
web, mitigation, vendor-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2026-33413
advisory, web
github.com /etcd-io/etcd
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary