CVE-2026-73499 etcd-io CVE debrief

Who should care

Defenders of etcd clusters, particularly those with authentication enabled, should assess exposure and prioritize patching. This includes reviewing etcd cluster configurations, access controls, and applying patches to prevent potential exploitation. Operators, platform administrators, vulnerability management teams, and security teams should be aware of the potential impacts and take necessary actions.

Why it matters

CVE-2026-73499 is a high-severity vulnerability in etcd that allows users with limited permissions to access sensitive data. Defenders should prioritize verifying etcd cluster configurations, reviewing access controls, and applying patches to prevent potential exploitation.

• Potential unauthorized access to sensitive data
• Possible disruption of etcd cluster operations
• Need for verification of etcd cluster configurations and access controls
• Requirement for patching etcd versions to prevent exploitation

Technical summary

The etcd distributed key-value store has a vulnerability prior to versions 3.5.33, 3.6.14, and 3.7.1, allowing users with READ permission on a single exact key to receive watch events for every key lexicographically greater than or equal to the permitted key using the Watch gRPC API with clientv3.WithFromKey(). This issue affects clusters with authentication enabled and could lead to potential unauthorized access to sensitive data and disruption of etcd cluster operations. The vulnerability is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

Defensive priority

Defenders should prioritize verifying etcd cluster configurations, reviewing access controls, and applying patches.

Recommended defensive actions

• Verify etcd cluster configurations and access controls
• Review and apply patches for etcd versions 3.5.33, 3.6.14, and 3.7.1
• Monitor etcd cluster activity for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the etcd vulnerability, including its impact on clusters with authentication enabled. The vulnerability is fixed in versions 3.5.33, 3.6.14, and 3.7.1. Defenders should verify etcd cluster configurations, review access controls, and apply patches to prevent potential exploitation. Evidence is limited to public CVE and NVD records, with no additional source details available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.