# go.etcd.io/etcd/v3 (Go) vulnerabilities 10 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v3.7.3 (Oct 22, 2026): no advisory affects it - Newest unaffected release: v3.7.3 (Oct 22, 2026), the latest release - Releases: 76 since v3.5.0 (Jun 15, 2021) - Registry: https://pkg.go.dev/go.etcd.io/etcd/v3 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-73500: v3.5.0-alpha.0 to v3.5.32 (v3.5.33 is outside it); v3.6.0 to v3.6.13 (v3.6.14 is outside it); v3.7.0-alpha.0 to v3.7.0 (v3.7.1 is outside it) - CVE-2026-73499: v3.5.0-alpha.0 to v3.5.32 (v3.5.33 is outside it); v3.6.0 to v3.6.13 (v3.6.14 is outside it); v3.7.0-alpha.0 to v3.7.0 (v3.7.1 is outside it) - CVE-2026-44283: v3.5.0 to v3.5.29 (v3.5.30 is outside it); v3.6.0 to v3.6.10 (v3.6.11 is outside it) - CVE-2026-33413: v3.5.0-alpha.0 to v3.5.27 (v3.5.28 is outside it); v3.6.0-alpha.0 to v3.6.8 (v3.6.9 is outside it) - CVE-2026-33343: v3.5.0-alpha.0 to v3.5.27 (v3.5.28 is outside it); v3.6.0-alpha.0 to v3.6.8 (v3.6.9 is outside it) - CVE-2021-28235: no published release is affected - CVE-2020-15112: no published release is affected - CVE-2020-15106: no published release is affected - CVE-2018-16886: no published release is affected - CVE-2018-1098: no published release is affected ## Advisories (10) ### [CVE-2026-73500](https://cve.now/CVE-2026-73500): etcd: \`tlsListener.acceptLoop\` spawns unbounded handshake goroutines with no deadline - Severity: High 8.7 - Published: Aug 12, 2026 - Affected: from 3.7.0-alpha.0, fixed in 3.7.1; from 3.6.0, fixed in 3.6.14; fixed in 3.5.33. - Fixed in v3.5.33 (released Jul 23, 2026, 20 days before disclosure), v3.6.14 (released Jul 23, 2026, 20 days before disclosure) and v3.7.1 (released Jul 23, 2026, 20 days before disclosure). - The latest release, v3.7.3, is not affected. ### [CVE-2026-73499](https://cve.now/CVE-2026-73499): etcd: Watch API authorization bypass via open-ended range requests - Severity: High 7.1 - Published: Aug 12, 2026 - Affected: from 3.7.0-alpha.0, fixed in 3.7.1; from 3.6.0, fixed in 3.6.14; fixed in 3.5.33. - Fixed in v3.5.33 (released Jul 23, 2026, 20 days before disclosure), v3.6.14 (released Jul 23, 2026, 20 days before disclosure) and v3.7.1 (released Jul 23, 2026, 20 days before disclosure). - The latest release, v3.7.3, is not affected. ### [CVE-2026-44283](https://cve.now/CVE-2026-44283): etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks - Severity: None 0.0 - Published: May 14, 2026 - Affected: from 3.6.0, fixed in 3.6.11; from 3.5.0, fixed in 3.5.30. - Fixed in v3.5.30 (released May 1, 2026, 13 days before disclosure) and v3.6.11 (released May 1, 2026, 13 days before disclosure). - The latest release, v3.7.3, is not affected. ### [CVE-2026-33413](https://cve.now/CVE-2026-33413): etcd: Authorization bypasses in multiple APIs - Severity: High 8.8 - Published: Mar 26, 2026 - Affected: fixed in 3.4.42; from 3.5.0-alpha.0, fixed in 3.5.28; from 3.6.0-alpha.0, fixed in 3.6.9; from 3.6.0-alpha.0, fixed in 3.6.9; from 3.5.0-alpha.0, fixed in 3.5.28; fixed in 3.4.42. - Fixed in v3.5.28 (released Mar 20, 2026, 6 days before disclosure, the advisory names 3.4.42, which was never published) and v3.6.9 (released Mar 20, 2026, 6 days before disclosure). - The latest release, v3.7.3, is not affected. ### [CVE-2026-33343](https://cve.now/CVE-2026-33343): etcd: Nested etcd transactions bypass RBAC authorization checks - Severity: None 0.0 - Published: Mar 26, 2026 - Affected: from 3.6.0-alpha.0, fixed in 3.6.9; from 3.5.0-alpha.0, fixed in 3.5.28; fixed in 3.4.42; fixed in 3.4.42; from 3.5.0-alpha.0, fixed in 3.5.28; from 3.6.0-alpha.0, fixed in 3.6.9. - Fixed in v3.5.28 (released Mar 20, 2026, 6 days before disclosure, the advisory names 3.4.42, which was never published) and v3.6.9 (released Mar 20, 2026, 6 days before disclosure). - The latest release, v3.7.3, is not affected. ### [CVE-2021-28235](https://cve.now/CVE-2021-28235): Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function. - Severity: Unrated - Published: Apr 4, 2023 - Affected: versions 3.4.10. - Fixed in v3.5.0 (released Jun 15, 2021, 658 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, v3.7.3, is not affected. ### [CVE-2020-15112](https://cve.now/CVE-2020-15112): Improper Input Validation in etcd - Severity: Medium 6.5 - Published: Aug 5, 2020 - Affected: fixed in 3.3.23; from 3.4.0, fixed in 3.4.10. - Fixed in v3.5.0 (released Jun 15, 2021, 314 days after disclosure, the advisory names 3.3.23, which was never published). - The latest release, v3.7.3, is not affected. ### [CVE-2020-15106](https://cve.now/CVE-2020-15106): Improper Input Validation in etcd - Severity: Medium 6.5 - Published: Aug 5, 2020 - Affected: fixed in 3.3.23; from 3.4.0, fixed in 3.4.10. - Fixed in v3.5.0 (released Jun 15, 2021, 314 days after disclosure, the advisory names 3.3.23, which was never published). - The latest release, v3.7.3, is not affected. ### [CVE-2018-16886](https://cve.now/CVE-2018-16886): etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access… - Severity: Medium 6.8 - Published: Jan 14, 2019 - Affected: from 3.2.0, fixed in 3.2.26; from 3.3.0, fixed in 3.3.11. - Fixed in v3.5.0 (released Jun 15, 2021, 883 days after disclosure, the advisory names 3.2.26, which was never published). - The latest release, v3.7.3, is not affected. ### [CVE-2018-1098](https://cve.now/CVE-2018-1098): A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. - Severity: Unrated - Published: Apr 3, 2018 - Affected: fixed in 3.4.0. - Fixed in v3.5.0 (released Jun 15, 2021, 1169 days after disclosure, the advisory names 3.4.0, which was never published). - The latest release, v3.7.3, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/go.etcd.io/etcd/v3 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.