CVE-2026-59818: etcd Cert Validation Flaw — Fix

Description

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.

Is your site exposed to CVE-2026-59818?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploit Prediction

0.0032

Probability of exploitation

0.24%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-295 CWE-295

Affected Products

Vendor	Product	Versions
etcd	etcd	< 3.5.32
etcd	etcd	3.6.0 — 3.6.13

References

Advisories & Patches

https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb https://github.com/etcd-io/etcd/pull/22007 https://github.com/etcd-io/etcd/pull/22021 https://github.com/etcd-io/etcd/pull/22025 https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92

Other References

https://github.com/etcd-io/etcd/releases/tag/v3.5.32 https://github.com/etcd-io/etcd/releases/tag/v3.6.13

Frequently Asked Questions

What is CVE-2026-59818? +

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2026-59818? +

CVE-2026-59818 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0032, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-59818? +

CVE-2026-59818 affects products from etcd, specifically: etcd. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-59818? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-44700

Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate …

CVE-2026-0277

An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) …

CVE-2025-3463

"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability …

CVE-2025-5279

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step …

CVE-2025-34066

An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with …

CVE-2025-7395

A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL client failing …

CVE-2026-59818