CVE-2026-73499
HighAdvisory
Published 24 Jul 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.1
- base score, highest
- EPSS
- 0.004
- 30th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 51
- of 17,781 indexed, latest versions
- Container images
- 42
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
etcd: Watch API authorization bypass via open-ended range requests
Carried by container images the latest versions of 51 of 17,781 indexed charts deploy, on 42 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| etcdbitnami | 3.5.7-0, 3.6.1-1, 3.6.4-0 | 3.5.33 | 4 |
| go.etcd.io/ | v3.3.0-rc.0.0.20200707003333-58bb8ae09f8e | 3.5.33 | 4 |
| go.etcd.io/ | v0.0.0-20231207102912-3b252db4f6e6, v0.0.0-20240910182045-f20bbadd404b, v0.0.0-20250327225636-a17edfd59754, v0.0.0-20250606201106-a4708beb0f5d+16 more | 3.5.33 | 37 |
Charts affected
51 by stars
Container images carrying it
42 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 6d4c9fe66e4f | go.etcd.io/ | 3.5.33 | 4 |
| ghcr.io/ | 824d6d78d451 | go.etcd.io/ | 3.5.33 | 4 |
| bitnamilegacy/ | 99b408c15272 | etcd go.etcd.io/ | 3.5.33 3.5.33 | 2 |
| k0sproject/ | f04635825d51 | go.etcd.io/ | 3.5.33 | 2 |
| lightninglabs/ | f86bbec4dfb3 | go.etcd.io/ | 3.5.33 | 2 |
| minio/ | bf85c57cdfcc | go.etcd.io/ | 3.5.33 | 2 |
| openebs/ | c86c06f1ce6a | etcd go.etcd.io/ | 3.5.33 3.5.33 | 2 |
| rancher/ | 12889bbcd1e8 | go.etcd.io/ | 3.5.33 | 2 |
| uselagoon/ | 2c89ed939b8b | go.etcd.io/ | 3.5.33 | 2 |
| quay.io/ | 702d7b4881c6 | go.etcd.io/ | 3.5.33 | 2 |
| gitea/ | 6120b1165f3a | go.etcd.io/ | 3.5.33 | 1 |
| grafana/ | 825c09373d27 | go.etcd.io/ | 3.5.33 | 1 |
| grafana/ | 3d85bb66e39b | go.etcd.io/ | 3.5.33 | 1 |
| huacnlee/ | 560be93229a5 | go.etcd.io/ | 3.5.33 | 1 |
| instill/ | c4a393e601ed | go.etcd.io/ | 3.5.33 | 1 |
| library/ | 2a232a42256f | go.etcd.io/ | 3.5.33 | 1 |
| library/ | aa3df78ecf32 | go.etcd.io/ | 3.5.33 | 1 |
| library/ | dd43b430341a | go.etcd.io/ | 3.5.33 | 1 |
| megaease/ | fad1c7452958 | go.etcd.io/ | 3.5.33 | 1 |
| milvusdb/ | 102aac62827b | etcd | 3.5.33 | 1 |
| milvusdb/ | fededb2f2d63 | etcd go.etcd.io/ | 3.5.33 3.5.33 | 1 |
| milvusdb/ | a3a55e1c1497 | go.etcd.io/ | 3.5.33 | 1 |
| minio/ | 053f103f4894 | go.etcd.io/ | 3.5.33 | 1 |
| minio/ | e2b7b633c250 | go.etcd.io/ | 3.5.33 | 1 |
| nerzhul/ | 4215df511f31 | go.etcd.io/ | 3.5.33 | 1 |
| thesisrobot/ | 287129953689 | go.etcd.io/ | 3.5.33 | 1 |
| thmmniii/ | 86105349c1a3 | go.etcd.io/ | 3.5.33 | 1 |
| traefik/ | acc7fcca5f1c | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 8ec6c4812a7e | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 269d0e55ea97 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 6c62e01e736b | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 6de40f528be9 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 5dfa86b6451f | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 90097a08b87c | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 45e744fc623f | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | ef92da4621e6 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 842975891182 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | d967d98a12dc | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 5d1c2cf4c538 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | b741efae8d31 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 9888240f644b | go.etcd.io/ | 3.5.33 | 1 |
| registry.k8s.io/ | e36c08168342 | go.etcd.io/ | 3.5.33 | 1 |