# CVE-2026-44283: etcd RBAC authorization bypass in transaction operations

Source: https://junglewise.ai/threats/cve-2026-44283-etcd-rbac-authorization-bypass-in-transaction-operations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-44283 · Severity: low · CVSS 3.1 · Published 2026-05-14

etcd is a critical database used to store and manage the configuration data for distributed systems like Kubernetes. A security flaw in its access control system could allow a user to read sensitive data or modify resource leases they should not have access to. While Kubernetes users are generally safe because they use a separate security layer, other systems relying on etcd's internal permissions should update to the latest version to prevent unauthorized data access.

Technologies: [Etcd-Io Etcd](https://junglewise.ai/threats/technologies/etcd), [go.etcd.io/etcd (Go)](https://junglewise.ai/threats/technologies/go-etcd-io-etcd), [go.etcd.io/etcd/v3 (Go)](https://junglewise.ai/threats/technologies/go-etcd-io-etcd-v3). Vendors: [Etcd-Io](https://junglewise.ai/threats/vendors/etcd-io), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44283 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44283 being exploited in the wild.

**How severe is CVE-2026-44283?** Low severity, with a CVSS score of 3.1, published 14 May 2026.

**Which products and versions are affected?** Etcd-Io Etcd < 3.4.44, < 3.5.30, < 3.6.11; go.etcd.io/etcd (Go) SEMVER:introduced=0,fixed=3.4.44; go.etcd.io/etcd/server/v3 (Go) SEMVER:introduced=3.5.0,fixed=3.5.30,introduced=3.6.0,fixed=3.6.11; go.etcd.io/etcd/v3 (Go) SEMVER:introduced=3.6.0,fixed=3.6.11.

**Is there a fix for CVE-2026-44283?** Yes. go.etcd.io/etcd (Go): upgrade to 3.4.44 or later; go.etcd.io/etcd/server/v3 (Go): upgrade to 3.6.11 or later; go.etcd.io/etcd/v3 (Go): upgrade to 3.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44283 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44283?** Check whether you run Etcd-Io Etcd, go.etcd.io/etcd (Go), go.etcd.io/etcd/server/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.etcd.io/etcd (Go): upgrade to 3.4.44 or later

  ```sh
  go get go.etcd.io/etcd@v3.4.44
  ```

- go.etcd.io/etcd/server/v3 (Go): upgrade to 3.6.11 or later

  ```sh
  go get go.etcd.io/etcd/server/v3@v3.6.11
  ```

- go.etcd.io/etcd/v3 (Go): upgrade to 3.6.11 or later

  ```sh
  go get go.etcd.io/etcd/v3@v3.6.11
  ```


## Technical details

An incorrect authorization vulnerability (CWE-863) exists in etcd's Role-Based Access Control (RBAC) implementation. The flaw is triggered when specific features, such as 'PrevKv' (previous key-value) or lease attachments, are used within 'Put' requests nested inside transaction operations. An authenticated attacker with limited permissions can exploit this to bypass authorization checks, allowing them to read unauthorized data or attach leases to keys. The vulnerability is resolved in versions 3.4.44, 3.5.30, and 3.6.11. Typical Kubernetes deployments are unaffected as they do not use etcd's native RBAC.

## Affected products

- etcd-io etcd < 3.4.44, < 3.5.30, < 3.6.11

## Identifiers

- CVE-2026-44283
- GHSA-x35m-3gp4-4fh5
- GO-2026-5736

## Timeline

- 2026-05-01: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE published to NVD

## References

- [https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5](https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5)

## Related threats

- [etcd TLS listener denial of service via connection exhaustion](https://junglewise.ai/threats/cve-2026-73500-etcd-tls-listener-denial-of-service-via-connection-exhaustion)
- [etcd authorization bypass in Watch gRPC API](https://junglewise.ai/threats/cve-2026-73499-etcd-authorization-bypass-in-watch-grpc-api)
- [etcd-io etcd improper certificate validation in gRPC listener](https://junglewise.ai/threats/cve-2026-59818-etcd-io-etcd-improper-certificate-validation-in-grpc-listener)
- [GO-2026-4808 - Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd](https://junglewise.ai/threats/cve-2026-33343-etcd-nested-etcd-transactions-bypass-rbac-authorization-checks)
- [GO-2026-4806 - Authorization bypasses in multiple APIs in go.etcd.io/etcd](https://junglewise.ai/threats/cve-2026-33413-etcd-authorization-bypasses-in-multiple-apis)