AZL-86898

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-86898.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-86898

Upstream

CVE-2026-44283

Published

2026-05-14T18:16:49Z

Modified

2026-08-28T17:48:00Z

Summary

CVE-2026-44283 affecting package etcd for versions less than 3.5.30-2

Details

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-44283

Affected packages

Azure Linux:3 / etcd

Package

Name: etcd
Purl: pkg:rpm/azure-linux/etcd

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.5.30-2

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-86898.json"