CVE-2026-59818

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-59818
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef Patch
https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f Patch
https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb Patch
https://github.com/etcd-io/etcd/pull/22007 Issue Tracking Patch
https://github.com/etcd-io/etcd/pull/22021 Issue Tracking Patch
https://github.com/etcd-io/etcd/pull/22025 Issue Tracking Patch
https://github.com/etcd-io/etcd/releases/tag/v3.5.32 Product Release Notes
https://github.com/etcd-io/etcd/releases/tag/v3.6.13 Product Release Notes
https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92 Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*
cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*
History

13 Jul 2026, 14:50

Type Values Removed Values Added
First Time Etcd etcd
Etcd
CPE cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*
References () https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef - () https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef - Patch
References () https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f - () https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f - Patch
References () https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb - () https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb - Patch
References () https://github.com/etcd-io/etcd/pull/22007 - () https://github.com/etcd-io/etcd/pull/22007 - Issue Tracking, Patch
References () https://github.com/etcd-io/etcd/pull/22021 - () https://github.com/etcd-io/etcd/pull/22021 - Issue Tracking, Patch
References () https://github.com/etcd-io/etcd/pull/22025 - () https://github.com/etcd-io/etcd/pull/22025 - Issue Tracking, Patch
References () https://github.com/etcd-io/etcd/releases/tag/v3.5.32 - () https://github.com/etcd-io/etcd/releases/tag/v3.5.32 - Product, Release Notes
References () https://github.com/etcd-io/etcd/releases/tag/v3.6.13 - () https://github.com/etcd-io/etcd/releases/tag/v3.6.13 - Product, Release Notes
References () https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92 - () https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92 - Mitigation, Vendor Advisory

08 Jul 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-07-08 21:16

Updated : 2026-07-13 14:50

NVD link : CVE-2026-59818

Mitre link : CVE-2026-59818

CVE.ORG link : CVE-2026-59818

JSON object : View

Products Affected

etcd

  • etcd
CWE
CWE-295

Improper Certificate Validation