etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to
an improper authentication issue when role-based access control (RBAC) is
used and client-cert-auth is enabled. If an etcd client server TLS
certificate contains a Common Name (CN) which matches a valid RBAC
username, a remote attacker may authenticate as that user with any valid
(trusted) client certificate in a REST API request to the gRPC-gateway.

#### Notes

Author| Note
—|—
[msalvatore]() | Introduced by https://github.com/etcd-io/etcd/commit/0191509637546621d6f2e18e074e955ab8ef374dRead More