CVE-2026-59818: etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.
Other sources
etcd: gRPC client listener does not enforce --client-crl-file certificate revocation
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.32-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.32 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59818?
The severity of CVE-2026-59818 is medium with a score of 6.5.
How do I fix CVE-2026-59818?
To fix CVE-2026-59818, upgrade to etcd version 3.5.32 or 3.6.13 or later.
What systems are affected by CVE-2026-59818?
CVE-2026-59818 affects etcd versions prior to 3.5.32 and 3.6.13.
What type of vulnerability is CVE-2026-59818?
CVE-2026-59818 is a security vulnerability related to the enforcement of the Certificate Revocation List in gRPC client listeners.
Is there a workaround for CVE-2026-59818?
As of now, it is recommended to upgrade to the patched versions as there are no documented workarounds for CVE-2026-59818.