CVE-2026-44283 | BDVDB-2026-333372 Detail

Description#

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-14Record published in the CVE List.
2. Version 22026-05-16Most recent update recorded in the CVE List.