CVE-2026-59818: CWE-295: Improper Certificate Validation in etcd-io etcd
A vulnerability in etcd prior to versions 3.5.32 and 3.6.13 allows improper enforcement of Certificate Revocation Lists (CRLs) on gRPC client listeners when HTTP and gRPC endpoints are split. This permits clients with revoked certificates to authenticate successfully over gRPC. The issue is fixed in versions 3.5.32 and 3.6.13.
AI Analysis
Technical Summary
CVE-2026-59818 is an improper certificate validation vulnerability (CWE-295) in etcd, a distributed key-value store. When etcd is configured with --listen-client-http-urls to separate HTTP and gRPC client endpoints, the --client-crl-file setting is not enforced on the gRPC listener. This allows clients presenting revoked certificates to authenticate over gRPC, potentially leading to unauthorized access. The vulnerability affects versions prior to 3.5.32 and 3.6.13, where the issue has been fixed.
Potential Impact
Clients with revoked certificates can still authenticate successfully over the gRPC listener, bypassing intended certificate revocation checks. This can lead to unauthorized access with high confidentiality and integrity impact, though availability is not affected.
Mitigation Recommendations
Upgrade etcd to version 3.5.32 or 3.6.13 or later, where the certificate revocation enforcement on gRPC listeners is fixed. Patch status is not explicitly stated in the vendor advisory, but the fix is included in these versions. No other mitigation is indicated.
CVE-2026-59818: CWE-295: Improper Certificate Validation in etcd-io etcd
Description
A vulnerability in etcd prior to versions 3.5.32 and 3.6.13 allows improper enforcement of Certificate Revocation Lists (CRLs) on gRPC client listeners when HTTP and gRPC endpoints are split. This permits clients with revoked certificates to authenticate successfully over gRPC. The issue is fixed in versions 3.5.32 and 3.6.13.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59818 is an improper certificate validation vulnerability (CWE-295) in etcd, a distributed key-value store. When etcd is configured with --listen-client-http-urls to separate HTTP and gRPC client endpoints, the --client-crl-file setting is not enforced on the gRPC listener. This allows clients presenting revoked certificates to authenticate over gRPC, potentially leading to unauthorized access. The vulnerability affects versions prior to 3.5.32 and 3.6.13, where the issue has been fixed.
Potential Impact
Clients with revoked certificates can still authenticate successfully over the gRPC listener, bypassing intended certificate revocation checks. This can lead to unauthorized access with high confidentiality and integrity impact, though availability is not affected.
Mitigation Recommendations
Upgrade etcd to version 3.5.32 or 3.6.13 or later, where the certificate revocation enforcement on gRPC listeners is fixed. Patch status is not explicitly stated in the vendor advisory, but the fix is included in these versions. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-07T15:00:50.978Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4ebdf7c9d9e3dbe3bf8b4b
Added to database: 07/08/2026, 21:15:35 UTC
Last enriched: 07/08/2026, 21:28:53 UTC
Last updated: 07/08/2026, 21:28:53 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.