CVE-2026-59818: etcd-io etcd improper certificate validation in gRPC listener

CVE-2026-59818 · Severity: medium · CVSS 6.5 · Published 2026-07-08

etcd is a critical distributed database used to store configuration and state data for large-scale systems like Kubernetes. A security flaw was discovered where the system fails to check if a user's security certificate has been revoked when using specific network settings. This could allow a previously authorized user or service, whose access was supposed to be cancelled, to continue accessing or modifying sensitive system data.

Technologies: Etcd-Io Etcd. Vendors: Etcd-Io.

Quick answers

Is CVE-2026-59818 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59818 being exploited in the wild.
How severe is CVE-2026-59818?
Medium severity, with a CVSS score of 6.5, published 8 July 2026.
Which products and versions are affected?
Etcd-Io Etcd < 3.5.32, >= 3.6.0-alpha.0, < 3.6.13.
Is there a fix for CVE-2026-59818?
A patch was published on 2026-07-01: Fixes merged and releases v3.5.32 and v3.6.13 published. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59818 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59818?
Check whether you run Etcd-Io Etcd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in etcd's certificate validation logic when the '--listen-client-http-urls' flag is used to separate HTTP and gRPC traffic onto different listeners. In this configuration, the '--client-crl-file' (Certificate Revocation List) is only enforced on the HTTP listener and not the gRPC listener. An attacker possessing a revoked but otherwise valid certificate can bypass authentication controls to interact with the etcd cluster via gRPC. This issue is classified as Improper Certificate Validation (CWE-295) and is resolved in versions 3.5.32 and 3.6.13.

Affected products

  • etcd-io etcd < 3.5.32, >= 3.6.0-alpha.0, < 3.6.13

Timeline

  • 2026-07-01: patched: Fixes merged and releases v3.5.32 and v3.6.13 published.
  • 2026-07-08: advisory: CVE-2026-59818 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.