# How Strix found a critical auth bypass in etcd

etcd's authApplierV3 wrapper omitted overrides for Alarm, Compaction and LeaseGrant, letting unauthenticated gRPC callers on port 2379 invoke them without permission checks.

- Payout: Research
- Severity: high
- Program: etcd
- Write-up by: Strix
- Disclosed: 2026-04-12
- CVE: CVE-2026-33413
- Write-up quality: 7/10
- Original: https://www.strix.ai/blog/where-others-missed-it-etcd-auth-bypass
- Library page: https://bugbountylibrary.com/r/blog%3Astrix-ai-blog-where-others-missed-it-etcd-auth-bypass
- Tags: area:cloud domain:infra impact:dos impact:integrity kind:research platform:research sev:high tech:go tech:grpc technique:source-review vuln:access-control vuln:auth-bypass vuln:dos

**Target:** etcd client gRPC endpoint (port 2379) / applier chain
**Root cause:** authApplierV3 embeds the applierV3 interface and only overrides some methods for permission checks; Alarm, Compaction and LeaseGrant were not overridden, so calls fell through to applierV3Backend and executed without authorization.
**Steps:**
1. Start etcd with `--listen-client-urls http://127.0.0.1:2379 --advertise-client-urls http://127.0.0.1:2379`
2. Create root user and enable auth: `etcdctl user add root:rootpass`, `etcdctl user grant-role root root`, `etcdctl auth enable`
3. Connect as unauthenticated or non-admin client
4. Call Maintenance.Alarm with `Action: ACTIVATE, Alarm: NOSPACE` and observe alarm activation
5. Call KV.Compact with `Revision: 1, Physical: true` and observe compaction proceeds
6. Call Lease.LeaseGrant with `TTL: 60` and observe lease creation succeeds
**How found:** Agent read server/etcdserver/apply/auth.go and noticed authApplierV3 embeds applierV3 but only overrides Put, Range, DeleteRange, Txn and auth-management methods; hypothesized non-overridden methods pass straight to the backend, then built a test env and PoC to confirm.
**Exploitation:** Any client with network access to the gRPC endpoint on 2379, without credentials or with a non-admin token, sends Alarm/Compact/LeaseGrant RPCs; handlers forward to Raft and the applier executes them without a second auth check, allowing alarm manipulation, history-destroying compaction/DoS, and lease creation to exhaust resources.
**Insight:** In Go auth-wrapper patterns that embed an interface, enumerate every method of the embedded interface and check which ones lack an override — any un-overridden method silently bypasses the permission check.