CVE-2026-44283

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44283
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44283.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44283
Aliases
Downstream
Related
Published
2026-05-14T17:01:33.598Z
Modified
2026-07-15T01:48:52.499276242Z
Severity
  • 0.0 (None) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N CVSS Calculator
Summary
etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks
Details

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44283.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/etcd-io/etcd

Affected ranges

Type
GIT
Repo
https://github.com/etcd-io/etcd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
59098950c8e467cdf3cf234b56b57449fec1a507
Introduced
946a5a6f25c3b6b89408ab447852731bde6e6289
Fixed
7d20602453b3a5ad9eda401510ea53522c611ee3
Introduced
f5d605a93abe2fdfa13880aab0f1f3a4203628dd
Fixed
ec166e2292a58365c90e96fcd206b3b74938d49d
Database specific 
{
    "cpe": "cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.4.44"
        },
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "3.5.30"
        },
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.11"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

Other
0
api/v3.*
api/v3.5.0
api/v3.5.1
api/v3.5.10
api/v3.5.11
api/v3.5.12
api/v3.5.13
api/v3.5.14
api/v3.5.15
api/v3.5.16
api/v3.5.17
api/v3.5.18
api/v3.5.19
api/v3.5.2
api/v3.5.20
api/v3.5.21
api/v3.5.22
api/v3.5.23
api/v3.5.24
api/v3.5.25
api/v3.5.26
api/v3.5.27
api/v3.5.28
api/v3.5.29
api/v3.5.3
api/v3.5.4
api/v3.5.5
api/v3.5.6
api/v3.5.7
api/v3.5.8
api/v3.5.9
api/v3.6.0
api/v3.6.1
api/v3.6.10
api/v3.6.2
api/v3.6.3
api/v3.6.4
api/v3.6.5
api/v3.6.6
api/v3.6.7
api/v3.6.8
api/v3.6.9
client/pkg/v3.*
client/pkg/v3.5.0
client/pkg/v3.5.1
client/pkg/v3.5.10
client/pkg/v3.5.11
client/pkg/v3.5.12
client/pkg/v3.5.13
client/pkg/v3.5.14
client/pkg/v3.5.15
client/pkg/v3.5.16
client/pkg/v3.5.17
client/pkg/v3.5.18
client/pkg/v3.5.19
client/pkg/v3.5.2
client/pkg/v3.5.20
client/pkg/v3.5.21
client/pkg/v3.5.22
client/pkg/v3.5.23
client/pkg/v3.5.24
client/pkg/v3.5.25
client/pkg/v3.5.26
client/pkg/v3.5.27
client/pkg/v3.5.28
client/pkg/v3.5.29
client/pkg/v3.5.3
client/pkg/v3.5.4
client/pkg/v3.5.5
client/pkg/v3.5.6
client/pkg/v3.5.7
client/pkg/v3.5.8
client/pkg/v3.5.9
client/pkg/v3.6.0
client/pkg/v3.6.1
client/pkg/v3.6.10
client/pkg/v3.6.2
client/pkg/v3.6.3
client/pkg/v3.6.4
client/pkg/v3.6.5
client/pkg/v3.6.6
client/pkg/v3.6.7
client/pkg/v3.6.8
client/pkg/v3.6.9
client/v2.*
client/v2.305.0
client/v2.305.1
client/v2.305.10
client/v2.305.11
client/v2.305.12
client/v2.305.13
client/v2.305.14
client/v2.305.15
client/v2.305.16
client/v2.305.17
client/v2.305.18
client/v2.305.19
client/v2.305.2
client/v2.305.20
client/v2.305.21
client/v2.305.22
client/v2.305.23
client/v2.305.24
client/v2.305.25
client/v2.305.26
client/v2.305.27
client/v2.305.28
client/v2.305.29
client/v2.305.3
client/v2.305.4
client/v2.305.5
client/v2.305.6
client/v2.305.7
client/v2.305.8
client/v2.305.9
client/v3.*
client/v3.5.0
client/v3.5.1
client/v3.5.10
client/v3.5.11
client/v3.5.12
client/v3.5.13
client/v3.5.14
client/v3.5.15
client/v3.5.16
client/v3.5.17
client/v3.5.18
client/v3.5.19
client/v3.5.2
client/v3.5.20
client/v3.5.21
client/v3.5.22
client/v3.5.23
client/v3.5.24
client/v3.5.25
client/v3.5.26
client/v3.5.27
client/v3.5.28
client/v3.5.29
client/v3.5.3
client/v3.5.4
client/v3.5.5
client/v3.5.6
client/v3.5.7
client/v3.5.8
client/v3.5.9
client/v3.6.0
client/v3.6.1
client/v3.6.10
client/v3.6.2
client/v3.6.3
client/v3.6.4
client/v3.6.5
client/v3.6.6
client/v3.6.7
client/v3.6.8
client/v3.6.9
etcdctl/v3.*
etcdctl/v3.5.0
etcdctl/v3.5.1
etcdctl/v3.5.10
etcdctl/v3.5.11
etcdctl/v3.5.12
etcdctl/v3.5.13
etcdctl/v3.5.14
etcdctl/v3.5.15
etcdctl/v3.5.16
etcdctl/v3.5.17
etcdctl/v3.5.18
etcdctl/v3.5.19
etcdctl/v3.5.2
etcdctl/v3.5.20
etcdctl/v3.5.21
etcdctl/v3.5.22
etcdctl/v3.5.23
etcdctl/v3.5.24
etcdctl/v3.5.25
etcdctl/v3.5.26
etcdctl/v3.5.27
etcdctl/v3.5.28
etcdctl/v3.5.29
etcdctl/v3.5.3
etcdctl/v3.5.4
etcdctl/v3.5.5
etcdctl/v3.5.6
etcdctl/v3.5.7
etcdctl/v3.5.8
etcdctl/v3.5.9
etcdctl/v3.6.0
etcdctl/v3.6.1
etcdctl/v3.6.10
etcdctl/v3.6.2
etcdctl/v3.6.3
etcdctl/v3.6.4
etcdctl/v3.6.5
etcdctl/v3.6.6
etcdctl/v3.6.7
etcdctl/v3.6.8
etcdctl/v3.6.9
etcdutl/v3.*
etcdutl/v3.5.0
etcdutl/v3.5.1
etcdutl/v3.5.10
etcdutl/v3.5.11
etcdutl/v3.5.12
etcdutl/v3.5.13
etcdutl/v3.5.14
etcdutl/v3.5.15
etcdutl/v3.5.16
etcdutl/v3.5.17
etcdutl/v3.5.18
etcdutl/v3.5.19
etcdutl/v3.5.2
etcdutl/v3.5.20
etcdutl/v3.5.21
etcdutl/v3.5.22
etcdutl/v3.5.23
etcdutl/v3.5.24
etcdutl/v3.5.25
etcdutl/v3.5.26
etcdutl/v3.5.27
etcdutl/v3.5.28
etcdutl/v3.5.29
etcdutl/v3.5.3
etcdutl/v3.5.4
etcdutl/v3.5.5
etcdutl/v3.5.6
etcdutl/v3.5.7
etcdutl/v3.5.8
etcdutl/v3.5.9
etcdutl/v3.6.0
etcdutl/v3.6.1
etcdutl/v3.6.10
etcdutl/v3.6.2
etcdutl/v3.6.3
etcdutl/v3.6.4
etcdutl/v3.6.5
etcdutl/v3.6.6
etcdutl/v3.6.7
etcdutl/v3.6.8
etcdutl/v3.6.9
pkg/v3.*
pkg/v3.5.0
pkg/v3.5.1
pkg/v3.5.10
pkg/v3.5.11
pkg/v3.5.12
pkg/v3.5.13
pkg/v3.5.14
pkg/v3.5.15
pkg/v3.5.16
pkg/v3.5.17
pkg/v3.5.18
pkg/v3.5.19
pkg/v3.5.2
pkg/v3.5.20
pkg/v3.5.21
pkg/v3.5.22
pkg/v3.5.23
pkg/v3.5.24
pkg/v3.5.25
pkg/v3.5.26
pkg/v3.5.27
pkg/v3.5.28
pkg/v3.5.29
pkg/v3.5.3
pkg/v3.5.4
pkg/v3.5.5
pkg/v3.5.6
pkg/v3.5.7
pkg/v3.5.8
pkg/v3.5.9
pkg/v3.6.0
pkg/v3.6.1
pkg/v3.6.10
pkg/v3.6.2
pkg/v3.6.3
pkg/v3.6.4
pkg/v3.6.5
pkg/v3.6.6
pkg/v3.6.7
pkg/v3.6.8
pkg/v3.6.9
raft/v3.*
raft/v3.5.0
raft/v3.5.1
raft/v3.5.10
raft/v3.5.11
raft/v3.5.12
raft/v3.5.13
raft/v3.5.14
raft/v3.5.15
raft/v3.5.16
raft/v3.5.17
raft/v3.5.18
raft/v3.5.19
raft/v3.5.2
raft/v3.5.20
raft/v3.5.21
raft/v3.5.22
raft/v3.5.23
raft/v3.5.24
raft/v3.5.25
raft/v3.5.26
raft/v3.5.27
raft/v3.5.28
raft/v3.5.29
raft/v3.5.3
raft/v3.5.4
raft/v3.5.5
raft/v3.5.6
raft/v3.5.7
raft/v3.5.8
raft/v3.5.9
server/v3.*
server/v3.5.0
server/v3.5.1
server/v3.5.10
server/v3.5.11
server/v3.5.12
server/v3.5.13
server/v3.5.14
server/v3.5.15
server/v3.5.16
server/v3.5.17
server/v3.5.18
server/v3.5.19
server/v3.5.2
server/v3.5.20
server/v3.5.21
server/v3.5.22
server/v3.5.23
server/v3.5.24
server/v3.5.25
server/v3.5.26
server/v3.5.27
server/v3.5.28
server/v3.5.29
server/v3.5.3
server/v3.5.4
server/v3.5.5
server/v3.5.6
server/v3.5.7
server/v3.5.8
server/v3.5.9
server/v3.6.0
server/v3.6.1
server/v3.6.10
server/v3.6.2
server/v3.6.3
server/v3.6.4
server/v3.6.5
server/v3.6.6
server/v3.6.7
server/v3.6.8
server/v3.6.9
tests/v3.*
tests/v3.5.0
tests/v3.5.1
tests/v3.5.10
tests/v3.5.11
tests/v3.5.12
tests/v3.5.13
tests/v3.5.14
tests/v3.5.15
tests/v3.5.16
tests/v3.5.17
tests/v3.5.18
tests/v3.5.19
tests/v3.5.2
tests/v3.5.20
tests/v3.5.21
tests/v3.5.22
tests/v3.5.23
tests/v3.5.24
tests/v3.5.25
tests/v3.5.26
tests/v3.5.27
tests/v3.5.28
tests/v3.5.29
tests/v3.5.3
tests/v3.5.4
tests/v3.5.5
tests/v3.5.6
tests/v3.5.7
tests/v3.5.8
tests/v3.5.9
tests/v3.6.0
tests/v3.6.1
tests/v3.6.10
tests/v3.6.2
tests/v3.6.3
tests/v3.6.4
tests/v3.6.5
tests/v3.6.6
tests/v3.6.7
tests/v3.6.8
tests/v3.6.9
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.2.0
v0.2.0-rc1
v0.2.0-rc2
v0.2.0-rc3
v0.2.0-rc4
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.5.0-alpha.0
v0.5.0-alpha.1
v0.5.0-alpha.2
v0.5.0-alpha.3
v0.5.0-alpha.4
v0.5.0-alpha.5
v2.*
v2.0.0
v2.0.0-rc.1
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0
v2.1.0-alpha.0
v2.1.0-alpha.1
v2.1.0-rc.0
v2.1.1
v2.2.0
v2.2.0-alpha.0
v2.2.0-alpha.1
v2.2.0-rc.0
v2.3.0
v2.3.0-alpha.0
v2.3.0-alpha.1
v3.*
v3.0.0-beta.0
v3.1.0-alpha.0
v3.1.0-alpha.1
v3.1.0-rc.0
v3.1.0-rc.1
v3.2.0+git
v3.2.0-rc.0
v3.2.0-rc.1
v3.2.0_plus_git
v3.2.10_plus_git
v3.3.0-rc.0
v3.3.9_plus_git
v3.4.0
v3.4.0-rc.0
v3.4.0-rc.1
v3.4.0-rc.2
v3.4.0-rc.3
v3.4.0-rc.4
v3.4.1
v3.4.10
v3.4.11
v3.4.12
v3.4.13
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.19
v3.4.2
v3.4.20
v3.4.21
v3.4.22
v3.4.23
v3.4.24
v3.4.25
v3.4.26
v3.4.27
v3.4.28
v3.4.29
v3.4.3
v3.4.30
v3.4.31
v3.4.32
v3.4.33
v3.4.34
v3.4.35
v3.4.36
v3.4.37
v3.4.38
v3.4.39
v3.4.4
v3.4.40
v3.4.41
v3.4.42
v3.4.43
v3.4.5
v3.4.6
v3.4.7
v3.4.8
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.11
v3.5.12
v3.5.13
v3.5.14
v3.5.15
v3.5.16
v3.5.17
v3.5.18
v3.5.19
v3.5.2
v3.5.20
v3.5.21
v3.5.22
v3.5.23
v3.5.24
v3.5.25
v3.5.26
v3.5.27
v3.5.28
v3.5.29
v3.5.3
v3.5.4
v3.5.5
v3.5.6
v3.5.7
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.10
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.6.6
v3.6.7
v3.6.8
v3.6.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44283.json"