Executive brief
Authorization bypasses in multiple APIs in go.etcd.io/etcd
Affected products
- Go go.etcd.io/etcd
- Go go.etcd.io/etcd/v3
Junglewise Threat Intelligence
CVE-2026-33413: GO-2026-4806 - Authorization bypasses in multiple APIs in go.etcd.io/etcd
CVE-2026-33413 · Severity: medium · CVSS 4 · Published 2026-04-07
Technologies: go.etcd.io/etcd (Go), go.etcd.io/etcd/v3 (Go). Vendors: Go.
Related threats
- GO-2026-4808 - Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd
- GO-2024-2528 - Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd
- GO-2024-2527 - Insecure ciphers are allowed by default in go.etcd.io/etcd
- GO-2024-2530 - Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd
- GO-2024-2529 - Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd