GHSA-xg4h-6gfc-h4m8: Anthropic Python Watch API auth

Q: Is GHSA-xg4h-6gfc-h4m8 actively exploited?

No confirmed active exploitation of GHSA-xg4h-6gfc-h4m8 has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-xg4h-6gfc-h4m8?

Patch etcd to 3.7.1, 3.6.14, or 3.5.33 as soon as possible — these releases fix the RBAC enforcement gap in the Watch API. Until patched, treat every existing READ grant as equivalent to full keyspace read access: audit role permissions (etcdctl role list/get) and revoke or tighten any READ grant you would not trust with unrestricted read. Restrict network reachability to etcd's client (gRPC) port via firewall/NetworkPolicy so only authorized components can even attempt a Watch call. For detection, review etcd access/audit logs for WithFromKey or open-ended range Watch requests originating from accounts scoped to a single key, and alert on Watch streams whose observed key range exceeds the account's intended RBAC grant.

Q: What systems are affected by GHSA-xg4h-6gfc-h4m8?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, agent frameworks.

Q: What is the CVSS score for GHSA-xg4h-6gfc-h4m8?

No CVSS score has been assigned yet.

CISO Take

etcd's Watch gRPC API lets a user holding READ permission on just one key open an unbounded 'from this key to the end' watch and receive change events for every key in the cluster, effectively defeating etcd's RBAC scoping for anyone who can reach the client port. This matters because etcd is the coordination and secrets backbone under most Kubernetes-based AI/ML stacks — model-serving clusters, Kubeflow/Ray training pipelines, and agent orchestration platforms all store configuration, service-discovery data, and often credentials in etcd, so a single narrowly-scoped read grant (e.g., a monitoring sidecar or a low-privilege microservice account) becomes a path to the entire keyspace. There's no CVSS score, EPSS data, CISA KEV listing, or public exploit/scanner template yet, so opportunistic mass exploitation is unlikely today, but the bug requires only a legitimate low-privilege credential and network access to the gRPC port — a realistic insider or lateral-movement scenario given etcd's 5,901 downstream dependents and 42 other CVEs in the package's history. Patch to etcd 3.7.1, 3.6.14, or 3.5.33 immediately; if you can't patch now, audit every READ grant (treat any READ as equivalent to full read access), restrict network reachability to the client port, and watch etcd audit/access logs for WithFromKey-style open-ended Watch calls from accounts that shouldn't need them.

Sources: GitHub Advisory ATLAS

What is the risk?

High severity per the GHSA advisory, but exploitation requires an attacker to already hold a valid etcd credential with at least one READ grant and network access to the client (gRPC) port — this is not an unauthenticated remote bug. No CVSS vector, EPSS score, CISA KEV listing, or public PoC/Nuclei template exists yet, so there's no evidence of active or automated exploitation. The realistic risk is insider misuse or post-compromise lateral movement: any service account, CI/CD pipeline, or third-party integration that was intentionally scoped to a single key (a common least-privilege pattern) can silently escalate to full keyspace read access via Watch, which is easy to overlook in a security review that only audits Range/Get grants. Because etcd underlies Kubernetes control planes and is a common coordination/secrets store for AI/ML platforms, exposure scales with how many narrowly-scoped credentials exist in a cluster and how sensitive the keyspace contents are (API keys, model registry paths, service tokens).

How does the attack unfold?

Scoped credential access

Attacker obtains or already holds a legitimate etcd credential with READ permission narrowly scoped to a single key, plus network access to the client (gRPC) port.

AML.T0012

RBAC bypass via open-ended Watch

Instead of using Range/Get, the attacker issues a Watch RPC with clientv3.WithFromKey() from their permitted key, which etcd fails to scope correctly under RBAC.

Full keyspace collection

etcd streams change events for every key lexicographically after the permitted key, letting the attacker continuously harvest secrets, credentials, and configuration outside their authorized scope.

AML.T0036

Sensitive data exposure and pivot

Exfiltrated secrets (API keys, service tokens, model-serving config) enable lateral movement into other components of the Kubernetes-hosted AI/ML pipeline.

AML.T0025

Scoped credential access

Attacker obtains or already holds a legitimate etcd credential with READ permission narrowly scoped to a single key, plus network access to the client (gRPC) port.

AML.T0012

RBAC bypass via open-ended Watch

Instead of using Range/Get, the attacker issues a Watch RPC with clientv3.WithFromKey() from their permitted key, which etcd fails to scope correctly under RBAC.

Full keyspace collection

etcd streams change events for every key lexicographically after the permitted key, letting the attacker continuously harvest secrets, credentials, and configuration outside their authorized scope.

AML.T0036

Sensitive data exposure and pivot

Exfiltrated secrets (API keys, service tokens, model-serving config) enable lateral movement into other components of the Kubernetes-hosted AI/ML pipeline.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 3.7.0-alpha.0, < 3.7.1	`3.7.1`
3.9K 6.1K dependents Pushed 9d ago 90% patched ~14d to patch Full package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Patch etcd to 3.7.1, 3.6.14, or 3.5.33 as soon as possible — these releases fix the RBAC enforcement gap in the Watch API. Until patched, treat every existing READ grant as equivalent to full keyspace read access: audit role permissions (etcdctl role list/get) and revoke or tighten any READ grant you would not trust with unrestricted read. Restrict network reachability to etcd's client (gRPC) port via firewall/NetworkPolicy so only authorized components can even attempt a Watch call. For detection, review etcd access/audit logs for WithFromKey or open-ended range Watch requests originating from accounts scoped to a single key, and alert on Watch streams whose observed key range exceeds the account's intended RBAC grant.

How is it classified?

Auth Bypass Data Leakage Framework API AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0036 - Data from Information Repositories

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.8 - Information security for AI system components

NIST AI RMF

MANAGE 4.1 - Risk treatment for third-party and infrastructure components

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is GHSA-xg4h-6gfc-h4m8?

etcd's Watch gRPC API lets a user holding READ permission on just one key open an unbounded 'from this key to the end' watch and receive change events for every key in the cluster, effectively defeating etcd's RBAC scoping for anyone who can reach the client port. This matters because etcd is the coordination and secrets backbone under most Kubernetes-based AI/ML stacks — model-serving clusters, Kubeflow/Ray training pipelines, and agent orchestration platforms all store configuration, service-discovery data, and often credentials in etcd, so a single narrowly-scoped read grant (e.g., a monitoring sidecar or a low-privilege microservice account) becomes a path to the entire keyspace. There's no CVSS score, EPSS data, CISA KEV listing, or public exploit/scanner template yet, so opportunistic mass exploitation is unlikely today, but the bug requires only a legitimate low-privilege credential and network access to the gRPC port — a realistic insider or lateral-movement scenario given etcd's 5,901 downstream dependents and 42 other CVEs in the package's history. Patch to etcd 3.7.1, 3.6.14, or 3.5.33 immediately; if you can't patch now, audit every READ grant (treat any READ as equivalent to full read access), restrict network reachability to the client port, and watch etcd audit/access logs for WithFromKey-style open-ended Watch calls from accounts that shouldn't need them.

Is GHSA-xg4h-6gfc-h4m8 actively exploited?

No confirmed active exploitation of GHSA-xg4h-6gfc-h4m8 has been reported, but organizations should still patch proactively.

How to fix GHSA-xg4h-6gfc-h4m8?

Patch etcd to 3.7.1, 3.6.14, or 3.5.33 as soon as possible — these releases fix the RBAC enforcement gap in the Watch API. Until patched, treat every existing READ grant as equivalent to full keyspace read access: audit role permissions (etcdctl role list/get) and revoke or tighten any READ grant you would not trust with unrestricted read. Restrict network reachability to etcd's client (gRPC) port via firewall/NetworkPolicy so only authorized components can even attempt a Watch call. For detection, review etcd access/audit logs for WithFromKey or open-ended range Watch requests originating from accounts scoped to a single key, and alert on Watch streams whose observed key range exceeds the account's intended RBAC grant.

What systems are affected by GHSA-xg4h-6gfc-h4m8?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, agent frameworks.

What is the CVSS score for GHSA-xg4h-6gfc-h4m8?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0036 Data from Information Repositories

Compliance Controls Affected

ISO 42001: A.8

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

### Impact _What kind of vulnerability is it? Who is impacted?_ A user granted READ permission on a single, exact key can use the Watch gRPC API with `clientv3.WithFromKey()` (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted. This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access. ### Patches _Has the problem been patched? What versions should users upgrade to?_ This vulnerability is patched in the following versions: - etcd 3.7.1 - etcd 3.6.14 - etcd 3.5.33 ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ If upgrading is not immediately possible, the following mitigations reduce exposure: - Audit READ grants. Any READ grant — even on one key — can be leveraged via Watch to read everything after it. Review who holds READ permissions and revoke/tighten any you wouldn't trust with full read access. - Restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation. ### Reporter - Luis Toro ([@lobuhi](https://github.com/lobuhi) on Github) - Anthropic and Adam Korczynski ([@AdamKorcz](https://github.com/AdamKorcz) on Github)

Exploitation Scenario

A CI/CD pipeline or monitoring sidecar in a Kubernetes-hosted AI/ML platform is granted READ permission on exactly one etcd key — say the config entry for its own service — following standard least-privilege practice. Instead of using Range/Get (which correctly enforces the RBAC scope), the credential holder — or an attacker who has stolen that credential via a compromised container or leaked secret — opens a gRPC Watch request with clientv3.WithFromKey() starting at their permitted key. etcd streams every subsequent key-value change lexicographically greater than that key, silently handing over secrets, other services' credentials, and model-serving configuration that RBAC was supposed to keep out of reach. The attacker now has a live feed of cluster-wide etcd writes, which they can mine for API keys, database credentials, or internal service tokens to pivot further into the AI pipeline.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.