CVE-2026-59818: CWE-295: Improper Certificate Validation in etcd-io etcd
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.
AI Analysis
Technical Summary
CVE-2026-59818 is a certificate validation vulnerability (CWE-295) in etcd, a distributed key-value store. When etcd is configured with --listen-client-http-urls to separate HTTP and gRPC client endpoints, the --client-crl-file option, which specifies a Certificate Revocation List, is not enforced on the gRPC listener. This flaw allows clients presenting revoked certificates to authenticate over gRPC. The vulnerability affects versions prior to 3.5.32 and 3.6.13, where the issue has been fixed.
Potential Impact
Clients with revoked certificates can still authenticate successfully over the gRPC interface, potentially allowing unauthorized access or actions that should have been blocked due to certificate revocation. This compromises the integrity of client authentication but does not affect availability.
Mitigation Recommendations
Upgrade etcd to version 3.5.32 or 3.6.13 or later, where the enforcement of the client CRL on the gRPC listener is fixed. No other mitigation or temporary workaround is indicated in the available data.
CVE-2026-59818: CWE-295: Improper Certificate Validation in etcd-io etcd
Description
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59818 is a certificate validation vulnerability (CWE-295) in etcd, a distributed key-value store. When etcd is configured with --listen-client-http-urls to separate HTTP and gRPC client endpoints, the --client-crl-file option, which specifies a Certificate Revocation List, is not enforced on the gRPC listener. This flaw allows clients presenting revoked certificates to authenticate over gRPC. The vulnerability affects versions prior to 3.5.32 and 3.6.13, where the issue has been fixed.
Potential Impact
Clients with revoked certificates can still authenticate successfully over the gRPC interface, potentially allowing unauthorized access or actions that should have been blocked due to certificate revocation. This compromises the integrity of client authentication but does not affect availability.
Mitigation Recommendations
Upgrade etcd to version 3.5.32 or 3.6.13 or later, where the enforcement of the client CRL on the gRPC listener is fixed. No other mitigation or temporary workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-07T15:00:50.978Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4ebdf7c9d9e3dbe3bf8b4b
Added to database: 07/08/2026, 21:15:35 UTC
Last enriched: 07/16/2026, 10:20:07 UTC
Last updated: 08/22/2026, 10:52:10 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.