# CVE-2026-59818: etcd-io etcd improper certificate validation in gRPC listener

Source: https://junglewise.ai/threats/cve-2026-59818-etcd-io-etcd-improper-certificate-validation-in-grpc-listener  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-59818 · Severity: medium · CVSS 6.5 · Published 2026-07-08

etcd is a critical distributed database used to store configuration and state data for large-scale systems like Kubernetes. A security flaw was discovered where the system fails to check if a user's security certificate has been revoked when using specific network settings. This could allow a previously authorized user or service, whose access was supposed to be cancelled, to continue accessing or modifying sensitive system data.

Technologies: [Etcd-Io Etcd](https://junglewise.ai/threats/technologies/etcd). Vendors: [Etcd-Io](https://junglewise.ai/threats/vendors/etcd-io).

## Quick answers

**Is CVE-2026-59818 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59818 being exploited in the wild.

**How severe is CVE-2026-59818?** Medium severity, with a CVSS score of 6.5, published 8 July 2026.

**Which products and versions are affected?** Etcd-Io Etcd < 3.5.32, >= 3.6.0-alpha.0, < 3.6.13.

**Is there a fix for CVE-2026-59818?** A patch was published on 2026-07-01: Fixes merged and releases v3.5.32 and v3.6.13 published. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59818 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59818?** Check whether you run Etcd-Io Etcd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in etcd's certificate validation logic when the '--listen-client-http-urls' flag is used to separate HTTP and gRPC traffic onto different listeners. In this configuration, the '--client-crl-file' (Certificate Revocation List) is only enforced on the HTTP listener and not the gRPC listener. An attacker possessing a revoked but otherwise valid certificate can bypass authentication controls to interact with the etcd cluster via gRPC. This issue is classified as Improper Certificate Validation (CWE-295) and is resolved in versions 3.5.32 and 3.6.13.

## Affected products

- etcd-io etcd < 3.5.32, >= 3.6.0-alpha.0, < 3.6.13

## Timeline

- 2026-07-01: patched: Fixes merged and releases v3.5.32 and v3.6.13 published.
- 2026-07-08: advisory: CVE-2026-59818 published.

## References

- [https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef](https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef)
- [https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f](https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f)
- [https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb](https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb)
- [https://github.com/etcd-io/etcd/pull/22007](https://github.com/etcd-io/etcd/pull/22007)
- [https://github.com/etcd-io/etcd/pull/22021](https://github.com/etcd-io/etcd/pull/22021)
- [https://github.com/etcd-io/etcd/pull/22025](https://github.com/etcd-io/etcd/pull/22025)
- [https://github.com/etcd-io/etcd/releases/tag/v3.5.32](https://github.com/etcd-io/etcd/releases/tag/v3.5.32)

## Related threats

- [etcd RBAC authorization bypass in transaction operations](https://junglewise.ai/threats/cve-2026-44283-etcd-rbac-authorization-bypass-in-transaction-operations)