A vulnerability in etcd allows an unauthorized user to bypass authentication or authorization checks on the gRPC API before version 3.4.42, 3.5.28, and 3.6.9. By calling MemberList, an adversary can discover cluster topology, including member IDs and advertised endpoints, thereby gaining a complete view of the distributed system. The attacker can also invoke Alarm to disrupt operations, use Lease APIs to interfere with TTL‑based keys and lease ownership, and trigger compaction to permanently erase historical revisions, thereby affecting audit and recovery workflows. These actions compromise confidentiality, integrity, and availability of the cluster storage, potentially enabling further attacks on applications relying on etcd.

etcd‑io’s etcd distributed key‑value store versions 3.4.x prior to 3.4.42, 3.5.x prior to 3.5.28, and 3.6.x prior to 3.6.9 are affected when authentication is enabled but the gRPC API is exposed to untrusted or partially trusted clients. Typical Kubernetes deployments are not impacted because Kubernetes performs authentication and authorization at the API server level, not within etcd.

The CVSS score of 8.8 indicates high severity, and the vulnerability is exploitable over the network via the gRPC interface. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the attack vector is inferred to be remote access to the etcd server ports. An attacker with network connectivity to the exposed API can exploit the authorization bypass, gaining full cluster read or modify capabilities without valid credentials.