etcd: revoked client certificates still authenticate on the gRPC listener when HTTP and gRPC are split

Impact

When etcd is run with --listen-client-http-urls to separate the HTTP and gRPC client endpoints, the certificate revocation list given in --client-crl-file is not applied to the gRPC listener. A client certificate that an operator has already revoked - a decommissioned apiserver, a leaked or rotated cluster credential - keeps full access to the key-value store over gRPC. For a Kubernetes control plane that means read and write access to every object in the cluster, including the secrets backing GPU tenants, so revocation no longer contains a credential compromise. Fixed in 3.5.32 and 3.6.13.

Who can reach it

Anyone who can reach the etcd gRPC client port holding a client certificate issued by the configured CA, including one that has been revoked. Normally that port is reachable only from the control-plane network.

What to do

Upgrade etcd to 3.5.32 or 3.6.13 and perform a rolling restart of the members - a daemon restart per control-plane node, no node drain. As an interim mitigation, stop splitting the listeners (drop --listen-client-http-urls) so the CRL is enforced, or re-issue the client CA so revoked certificates no longer chain to a trusted root.

References

Related entries

• containerd: On SELinux hosts, an unprivileged pod with a hostPath volume can gain full read/write to the host filesystemCVE-2021-43816 · containerdHigh
• Cilium: IPsec transparent encryption is cryptographically ineffectiveCVE-2024-28860 · CiliumHigh
• CRI-O: untrusted checkpoint archive on restore allows unintended host filesystem operationsCVE-2026-15801 · CRI-O (container checkpoint/restore metadata validation)High
• Nuclio controller: cron trigger headers and body are injected into the CronJob shell commandCVE-2026-52831 · Nuclio controller (cron trigger rendered into Kubernetes CronJob args)High
• Strimzi Cluster Operator: attacker-set watchedNamespace grants Secret read/write in other namespacesCVE-2026-55225 · Strimzi Kafka Operator (Cluster Operator, Kafka.spec.entityOperator.watchedNamespace)High
• Nuclio dashboard: unvalidated function namespace is interpolated into a shell docker ps commandCVE-2026-79755 · Nuclio dashboard (local/Docker platform, function namespace filter)High