etcd
v3.7.1Kubernetes CoreJul 23, 2026
etcd v3.7.1 is a security patch fixing a medium-severity watch-permission bypass (GHSA-xg4h-6gfc-h4m8) where a user with read access to one key could receive watch responses for all keys sharing that prefix. The release also includes hardening fixes for request and connection timeouts, memory bounds, and several bug fixes.
securityWatch permission bypass fixed
A user with read access to one key could receive watch responses for all keys sharing that prefix, bypassing intended permission boundaries (GHSA-xg4h-6gfc-h4m8). The fix ships in v3.7.1.
Key changes (5)
- Security: watch-permission bypass fixed (GHSA-xg4h-6gfc-h4m8)—a read-permitted user received watch events for all keys with a shared prefix
- Hardening: peer lease handler protects against unbounded memory use from oversized request bodies
- Hardening: snapshot size bounded with a reasonable default snapshotLimitByte
- Hardening: client HTTP server and TLS listener timeouts added to mitigate slow-header and hanging handshake issues
- Bug fixes: costTxnReq nested RequestTxn computation, leaseCache.entries data race in clientv3
Add etcd to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.