GO-2026-6114: go.etcd.io/etcd/server/v3 fixed in 3.7.1, 3.6.14 and 3.5.33

GO-2026-6114 PUBLISHED

Record from OSV · Published August 18, 2026

go.etcd.io/etcd/server/v3 is fixed in 3.7.1, 3.6.14 and 3.5.33 (Go Modules)

Watch API authorization bypass in go.etcd.io/etcd/server/v3

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

15 more packages have a fixed version. See every fix in Lookup.

Vendor	Product	Versions
chainguard	py3-etcd	*
chainguard	dapr-1.16	0
chainguard	dapr-fips-1.18	0
chainguard	kcp-fips-0.29	0
chainguard	docker-28	*
wolfi	dapr-1.17	0
wolfi	vcluster	*
chainguard	kcp-fips-0.31	0
chainguard	kcp-0.32	0
chainguard	kcp-fips-0.32	0
chainguard	rancher-support-bundle-kit	0
chainguard	kcp-fips-0.30	0
wolfi	docker-28	*
chainguard	dapr-fips-1.16	0
chainguard	multicluster-controlplane-fips	0
wolfi	py3-etcd	*
chainguard	kcp-0.29	0
chainguard	vcluster-fips	*
chainguard	kcp-0.31	0
go.etcd.io	etcd/server/v3	3.7.0-alpha.0, 0, 3.6.0

…and 16 more

The same record, from the CLI:

vulnetix vdb vuln GO-2026-6114
vulnetix vdb fixes GO-2026-6114

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2026-6114/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart