# NCC Group: an LLM pipeline found two etcd authorization bypasses

> A code graph, an LLM and live etcd instances produced two confirmed authorization bypasses, each with a CVE and a patch.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** NCC Group
- **Disclosed:** 2026-10-06
- **Affects:** etcd
- **Research by:** [Luis Toro Puig](https://github.com/lobuhi)
- **Primary source:** https://www.nccgroup.com/research/finding-two-authorization-bypasses-in-etcd-through-a-vulnerability-research-llm-assisted-pipeline/
- **Page:** https://theinjection.dev/items/nccgroup-llm-pipeline-etcd-authz/

NCC Group published on October 6, 2026 how an LLM-assisted pipeline found two authorization bypasses in etcd, both since fixed: a revocation list skipped on the gRPC listener, and a Watch API range that ignored RBAC.

## What happened

NCC Group researcher Luis Toro Puig described the pipeline and its results in a research post on October 6, 2026. The two flaws it produced, CVE-2026-59818 and CVE-2026-73499, went through etcd's own security advisories on July 1 and July 23, 2026 and are fixed. For the Watch API flaw, etcd credits Luis Toro alongside Anthropic and Adam Korczynski as reporters.

## How it works

Five stages make up the pipeline: graphify indexes the etcd repository into a code graph at a fixed commit, an LLM explores that graph to generate security hypotheses, live etcd instances built from the same revision validate them, each hypothesis is confirmed or rejected, and a report is generated. Validation against a running cluster is what separates a confirmed finding from a model's guess. NCC Group's post does not name the model it used.

## Who is affected

etcd clusters on the affected builds were exposed, and every affected branch now has a patched release, listed above. Neither flaw involves an AI product: etcd is the key-value store behind Kubernetes, and the AI part of this story is the discovery method. Teams judging AI-assisted vulnerability research are the audience for the pipeline itself.

## What to do

Run etcd 3.7.1, 3.6.14 or 3.5.33 or later, which carry both fixes. Clusters that split client endpoints with --listen-client-http-urls and rely on --client-crl-file should confirm the upgrade, because the revocation list was the control that failed there.

## Quick facts

- **CVEs:** CVE-2026-59818 and CVE-2026-73499
- **Affected:** Revocation flaw: etcd <=3.6.12, <=3.5.31. Watch flaw: etcd <=3.7.0, <=3.6.13, <=3.5.32
- **Fixed in:** Revocation flaw: 3.6.13, 3.5.32. Watch flaw: 3.7.1, 3.6.14, 3.5.33
- **Found by:** Luis Toro Puig, NCC Group
- **Co-reported:** Watch flaw also credited to Anthropic and Adam Korczynski
- **Method:** Code graph, LLM hypotheses, validation on live etcd instances
- **Disclosed:** Advisories July 1 and July 23, 2026; method post October 6, 2026

## Sources

1. [NCC Group Research](https://www.nccgroup.com/research/finding-two-authorization-bypasses-in-etcd-through-a-vulnerability-research-llm-assisted-pipeline/)
2. [etcd CRL Advisory](https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92)
3. [etcd Watch Advisory](https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8)