CVE-2026-59818
Received Received - Intake

Certificate Revocation Bypass in etcd

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-08
Generated
2026-07-09
AI Q&A
2026-07-09
EPSS Evaluated
N/A
NVD
CVE-2026-59818

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
etcd etcd to 3.5.32 (exc)
etcd etcd to 3.6.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in etcd versions prior to 3.5.32 and 3.6.13 when it is configured to split HTTP and gRPC client endpoints onto separate listeners using the --listen-client-http-urls option. In this configuration, the --client-crl-file, which is supposed to enforce a Certificate Revocation List (CRL), is not enforced on the gRPC listener. As a result, a client with a revoked certificate can still authenticate successfully over gRPC.

Impact Analysis

The vulnerability allows clients with revoked certificates to authenticate successfully over the gRPC listener. This can lead to unauthorized access to the etcd distributed key-value store, potentially compromising the confidentiality and integrity of the data stored within the system.

Mitigation Strategies

To mitigate this vulnerability, upgrade your etcd installation to version 3.5.32 or 3.6.13 or later, where the issue is fixed.

Ensure that when configuring etcd with --listen-client-http-urls to split HTTP and gRPC client endpoints, the --client-crl-file Certificate Revocation List enforcement applies to both listeners.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59818. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart