CVE-2026-59818 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation

What is CVE-2026-59818?

CVE-2026-59818 is a medium-severity vulnerability in etcd-io etcd, published on 8 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.

Weakness: CWE-295

Which versions are affected by CVE-2026-59818?

1 open source package ship an affected version, including etcd. It affects 1 product.

Products include Etcd Etcd.

How do I fix CVE-2026-59818?

Upgrade etcd to a fixed version for your release line: 3.5.32 or 3.6.13.

Is CVE-2026-59818 being exploited?

There is no known exploitation of CVE-2026-59818 in the wild and no public exploit code.

Other vulnerabilities in etcd-io etcd

• CVE-2021-28235 Etcd-io Improper Authentication vulnerability Critical 9.8
• CVE-2026-33413 etcd: Authorization bypasses in multiple APIs High 8.8
• CVE-2022-34038 Denial of service in n/a High 7.5
• CVE-2018-16886 go.etcd.io/etcd Authentication Bypass Medium 6.8
• CVE-2020-15106 Improper Input Validation in etcd Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-92141, BELL-CVE-2026-59818, BIT-etcd-2026-59818, DEBIAN-CVE-2026-59818, GHSA-3wh4-j44w-pg92, MINI-2p3r-7mx5-hg5j and 6 more.