Medium [CVE-2026-73499] Information disclosure via Watch API authorization bypass
This medium-severity Red Hat Linux advisory covers CVE-2026-73499 affecting Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Container Platform 4.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key.
In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled.
This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1. This allows them to receive watch events for keys beyond their authorized scope, leading to information disclosure.
Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-551.
Affected Red Hat products: Multicluster Global Hub; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat OpenShift Container Platform 4; Red Hat OpenShift GitOps; Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
- < 3.5.33
- < 3.6.14
- < 3.7.1
Official advisory · high-confidence parse· fetched 24 days ago·verify at source
- 3.5.33
- 3.6.14
- 3.7.1
Official advisory · high-confidence parse· fetched 24 days ago·verify at source
Mitigation checklist
- If etcd authentication is not required for the deployment, this vulnerability does not apply. For clusters with authentication enabled, restrict network-level access to the etcd gRPC API to trusted clients only, and audit user permissions to ensure the principle of least privilege.
Official advisory · high-confidence parse· fetched 24 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.