etcd fails to verify the client certificate revocation list when the "--listen-client-http and gRPC listeners, allowing a client with a revoked certificate to authenticate over gRPC. This bypass of revocation checks constitutes a broken authentication mechanism (CWE‑295) and can lead to unauthorized read or write operations against etcd, thereby exposing or compromising sensitive configuration data.

etcd‑io’s etcd versions 3.5.x prior to 3.5‑32 and 3.6.x prior to 3.6‑13 are affected when the split‑listener flag is enabled. Any deployment that exposes the gRPC endpoint to potential clients while using these older releases can be compromised; the vulnerability is fixed.

The CVSS score of 6.5 indicates moderate severity. The EP shows that exploitation probability is very low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network‑based attacker able to reach the gRPC listener who can present a revoked certificate to authenticate successfully; the lack of revocation enforcement makes the compromise straightforward for such an adversary.