etcd Nested Transaction Vulnerability Bypasses RBAC Authorization

A vulnerability exists in etcd, a distributed key-value store, prior to versions 3.4.42, 3.5.28, and 3.6.9. Authenticated users with RBAC restricted permissions on key ranges can exploit nested transactions to bypass key-level authorization. This allows access to the entire etcd data store, disregarding key range restrictions. While Kubernetes typically uses its own authentication and authorization methods, this vulnerability could impact other systems that rely on etcd's built-in RBAC.

Impact

Exploitation allows authenticated users to bypass key-level authorization, accessing the entire etcd data store without restrictions.

Remediation

Users can upgrade to etcd versions 3.4.42, 3.5.28, or 3.6.9. If an immediate upgrade is not possible, the affected RPCs can be treated as unauthenticated, restrict network access to etcd server ports, and require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution.