Logo
›
›vulnerability›CVE-2026-59818
Name
CVE-2026-59818
Source
NVD ( link)Debian ( link)
Description
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.
CWEs
CWE-295
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1befPatch
https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267fPatch
https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbbPatch
https://github.com/etcd-io/etcd/pull/22007Issue Tracking
https://github.com/etcd-io/etcd/pull/22021Issue Tracking
https://github.com/etcd-io/etcd/pull/22025Issue Tracking
https://github.com/etcd-io/etcd/releases/tag/v3.5.32Product
https://github.com/etcd-io/etcd/releases/tag/v3.6.13Product
https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92Mitigation

Analysis#

Affected Component
Analysis
etcd
Exploitable

Vulnerability Ratings#

6.5
CVSSv31
8.1
CVSSv31
NaN
other

Others affected component#

Name
Project
Project Version
Version
Status
etcd
yocto
scarthgap
3.5.7
Exploitable