etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation

[nixpkgs-security-tracker]

Nixpkgs security tracker issue

CVE-2026-59818

6.5 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.

References

• GHSA-3wh4-j44w-pg92 (x_refsource_CONFIRM)
• Reject the client request if the client certificate has been revoked etcd-io/etcd#22007 (x_refsource_MISC)
• [release-3.5] Reject the client request if the client certificate has been revoked etcd-io/etcd#22021 (x_refsource_MISC)
• [release-3.6] Reject the client request if the client certificate has been revoked etcd-io/etcd#22025 (x_refsource_MISC)
• etcd-io/etcd@2308ce1 (x_refsource_MISC)
• etcd-io/etcd@24838af (x_refsource_MISC)
• etcd-io/etcd@8221ae8 (x_refsource_MISC)
• https://github.com/etcd-io/etcd/releases/tag/v3.5.32 (x_refsource_MISC)
• https://github.com/etcd-io/etcd/releases/tag/v3.6.13 (x_refsource_MISC)

Affected packages

• etcd (pull requests)
  • 3.6.12@nixos-26.05
  • 3.6.12@nixos-unstable
• etcd_3_4 (pull requests)
  • 3.4.45@nixos-26.05
  • 3.4.45@nixos-unstable
• etcd_3_5 (pull requests)
  • 3.5.31@nixos-26.05
  • 3.5.31@nixos-unstable
• etcd_3_6 (pull requests)
  • 3.6.12@nixos-26.05
  • 3.6.12@nixos-unstable
    Affected package maintainers: cc @dtomvan

Next steps

• Start here if this is your first security issue: Triaging and fixing security issues
• Backports are usually needed: Backporting security fixes

[dtomvan]

3.5 and 3.6 have been updated. 3.4 is dropped. 3.7 released, so dropping 3.5 soon due to upstream maintaining schedule