etcd
v3.6.14Kubernetes CoreJul 23, 2026
etcd v3.6.14 is a security patch fixing GHSA-xg4h-6gfc-h4m8, a medium-severity watch permission disclosure where users with read access on one key could receive watch responses for keys beyond their granted range. Additional changes include internal hardening and bugfixes across request body handling, cost accounting, and connection timeouts.
securityWatch permission disclosure fixed
A user granted read permission on a single key could receive watch responses for all keys starting from that key, bypassing intended access controls. The fix ships in v3.6.14 and applies to all etcd server deployments where watch is used with key-range ACLs.
Key changes (6)
- Security: Watch permission disclosure fixed (GHSA-xg4h-6gfc-h4m8), where read access on one key leaked watch responses for subsequent keys
- Peer lease handler now bounds request body reads to prevent unbounded memory consumption
- Snapshot size handling improved with snapshotLimitByte default
- Request cost accounting corrected for nested transactions
- Client HTTP servers hardened with timeout settings (ReadHeaderTimeout, TLS handshake timeout)
- Lease cache thread-safety improved in clientv3
Add etcd to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.