CVE-2026-33413 Impact, Exploitability, and Mitigation Steps | Wiz

Overview

CVE-2026-33413 is an authorization bypass vulnerability (classified as "Authorization bypasses in multiple APIs") in etcd, the distributed key-value store widely used in cloud-native infrastructure. Multiple flaws allow unauthorized users to bypass authentication or authorization checks and invoke certain gRPC API functions in clusters that expose the gRPC API to untrusted or partially trusted clients. Affected versions include etcd ≤3.4.41, ≤3.5.27, and ≤3.6.8. The vulnerability was published on March 20, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Microsoft MSRC).

Technical details

The root cause is a missing authorization check (CWE-862) at the gRPC API layer in etcd, where certain API endpoints fail to enforce authentication or authorization even when etcd auth is enabled. The flaw is not isolated to a single endpoint but affects multiple APIs — MemberList, Alarm, Lease, and compaction — all sharing the same underlying defect in the gRPC API layer. An attacker with network access to the etcd gRPC port can send unauthenticated or low-privilege gRPC requests to these endpoints without valid credentials. The precondition for exploitation is that the etcd cluster must have auth enabled and the gRPC API must be reachable by untrusted or partially trusted clients; standard Kubernetes deployments are explicitly noted as unaffected because the Kubernetes API server provides its own authentication layer and does not rely on etcd's built-in auth (GitHub Advisory).

Successful exploitation enables unauthorized users to: (1) call MemberList to enumerate cluster topology including member IDs and advertised peer endpoints, facilitating reconnaissance; (2) invoke the Alarm API to trigger operational disruption or denial of service; (3) abuse Lease APIs to interfere with TTL-based key management and lease ownership, potentially causing data inconsistency; and (4) trigger compaction, which permanently removes historical key revisions and disrupts watch operations, audit trails, and disaster recovery workflows. The combination of information disclosure, availability disruption, and potential permanent data loss makes this a high-severity issue for any etcd deployment directly exposing its gRPC API to untrusted networks (GitHub Advisory, Feedly).

Exploitation steps

Indicators of compromise

Mitigation and workarounds

Community reactions

The vulnerability received coverage from multiple security news outlets including GBHackers, CyberSecurityNews, CyberPress, and IT Security News, with articles highlighting the risk of unauthorized access to sensitive cluster APIs (GBHackers, CyberSecurityNews). Strix Security published a technical blog post titled "Where Others Missed It: etcd Auth Bypass," authored by researchers Alex Schapiro and Ahmed Allam who were credited in the advisory (Strix Security). The vulnerability was discussed on Hacker News, reflecting community interest in the impact on etcd-backed infrastructure (Hacker News). The Hacker News and The Hacker Wire also covered the issue, and it was included in The Hacker News weekly recap (The Hacker News). OpenSUSE issued security announcements for affected packages, and Greenbone included it in their April 2026 threat report.

Additional resources

Source: This report was generated using AI

"Best User Experience I have ever seen, provides full visibility to cloud workloads."

"Wiz provides a single pane of glass to see what is going on in our cloud environments."

"We know that if Wiz identifies something as critical, it actually is."