A flaw in etcd’s Watch gRPC API allows a user who only has READ access to a single exact key to issue an open‑ended watch that returns events for all keys lexicographically greater than or equal to that key. The bug lies in the re‑writing of the RangeEnd sentinel before the RBAC permission check, causing the request to bypass the intended exact‑key filter. Consequently, an attacker can observe or download data not covered by their explicit permissions, leading to data disclosure.

etcd clusters running any of the following versions: 3.5.x prior to 3.5.33, 3.6.x prior to 3.6.14, or 3.7.x prior to 3.7.1, and which have authentication enabled. The fix is released in the mentioned versions and does not affect Range/Get or DeleteRange operations.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score indicates a probability of exploitation less than 1%, suggesting a very low likelihood that attackers will exploit this flaw. The issue is not listed in CISA’s KEV catalog. Attackers with read permission can exploit the flaw remotely via a client over gRPC, bypassing RBAC to watch and retrieve additional keys. The impact focuses on confidentiality, allowing data exfiltration across the key‑value store. No elevated privileges or denial of service are involved. The vulnerability can be exploited by any client that can execute a watch request against an authenticated etcd cluster.