N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44283

CVE-2026-44283: etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44283

CVE-2026-44283:

N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
go.etcd.io/etcd/v3	go	>= 3.6.0, <= 3.6.10	3.6.11
go.etcd.io/etcd/v3	go	>= 3.5.0, <= 3.5.29	3.5.30
go.etcd.io/etcd	go	<= 3.4.43	3.4.44

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an RBAC bypass in etcd's handling of transaction (Txn) requests. An authenticated user with limited permissions could exploit this to read unauthorized data or attach leases without permission. The root cause was an insufficient authorization check within the transaction processing logic.

The primary vulnerable function is checkTxnReqsPermission located in server/etcdserver/apply/apply_auth.go. When processing a Put request inside a transaction, this function only checked for write permission on the specified key. It failed to check for two important cases:

If the Put request included the PrevKv flag to retrieve the previous value, the system did not check if the user had read permission for that key.
If the Put request included a lease ID to attach a lease to the key, the system did not check if the user had permission to use that lease.

The entry point for an attacker is the EtcdServer.Txn gRPC method. This method receives the transaction request and passes it to the authorization logic. The patch for this vulnerability involved modifying the call chain starting from EtcdServer.Txn to pass a lessor object down to the permission checking functions. This allows the updated authorization logic in checkTxnReqsPermission (which now calls a new checkPutAuth function) to properly validate lease attachment permissions. The check for PrevKv is also handled within the new checkPutAuth function. Therefore, EtcdServer.Txn and checkTxnReqsPermission are the key functions that would appear in a runtime profile during exploitation.

Vulnerable functions

go.etcd.io/etcd/server/v3/etcdserver/apply.checkTxnReqsPermission

server/etcdserver/apply/apply_auth.go

This function is responsible for checking permissions for requests within a transaction. The vulnerability lies in the fact that for a `Put` request, it only checked for write permission on the key using `as.IsPutPermitted`. It did not perform additional checks for read permissions when `PrevKv` was requested, or for lease permissions when a lease was being attached. This allowed a user with only write permissions to perform unauthorized read operations or lease attachments.

go.etcd.io/etcd/server/v3/etcdserver.EtcdServer.Txn

server/etcdserver/v3_server.go

This is the gRPC handler for transaction requests and the entry point for the vulnerability. It calls the authorization logic that contains the flaw. The patch modified this function to pass the `lessor` to the authorization check, which is necessary to correctly verify lease attachment permissions.

go.etcd.io/etcd/server/v3/etcdserver/apply.CheckTxnAuth

server/etcdserver/apply/apply_auth.go

This function is a wrapper around the main transaction permission checking logic. It was modified to accept a `lessor` argument and pass it down to the underlying permission checking functions. This change was necessary to fix the lease attachment part of the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.