GO-2026-6114

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2026-6114
Import Source
https://vuln.go.dev/ID/GO-2026-6114.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2026-6114
Aliases
Downstream
Related
Published
2026-08-18T16:38:10Z
Modified
2026-08-19T21:41:58Z
Summary
Watch API authorization bypass in go.etcd.io/etcd/server/v3
Details

In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey(). The Watch RPC handler normalized open-ended range ends prior to authorization checks, causing isWatchPermitted to evaluate the request as a single-key watch while the underlying watch stream received events for all keys lexicographically greater than or equal to the target key.

Database specific 
{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6114"
}
References
Credits
    • Luis Toro (GitHub: lobuhi)
    • Anthropic
    • Adam Korczynski (GitHub: AdamKorcz)

Affected packages

Go / go.etcd.io/etcd/server/v3

Package

Name
go.etcd.io/etcd/server/v3
View open source insights on deps.dev
Purl
pkg:golang/go.etcd.io/etcd/server/v3

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.5.33
Introduced
3.6.0
Fixed
3.6.14
Introduced
3.7.0-alpha.0
Fixed
3.7.1

Ecosystem specific 

{
    "imports": [
        {
            "path": "go.etcd.io/etcd/server/v3/etcdserver/api/v3rpc",
            "symbols": [
                "NewWatchServer",
                "Server",
                "serverWatchStream.recvLoop",
                "watchServer.Watch"
            ]
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-6114.json"