---
id: CVE-2026-59818
title: etcd is a distributed key-value store for the data of a distributed system
summary: >-
  etcd is a distributed key-value store for the data of a distributed system.
  Prior to 3.5.32 and 3.6.13, when etcd is configured with
  --listen-client-http-urls to split HTTP and gRPC client endpoints onto
  separate listeners, the --client-…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-295
vendor: etcd
product: etcd
affected:
  - etcd < 3.5.32
  - 'etcd >= 3.6.0, < 3.6.13'
patched:
  - etcd 3.6.13
published: '2026-07-08'
updated: '2026-07-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59818'
references:
  - url: >-
      https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef
    label: security-advisories@github.com
  - url: >-
      https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f
    label: security-advisories@github.com
  - url: >-
      https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb
    label: security-advisories@github.com
  - url: 'https://github.com/etcd-io/etcd/pull/22007'
    label: security-advisories@github.com
  - url: 'https://github.com/etcd-io/etcd/pull/22021'
    label: security-advisories@github.com
  - url: 'https://github.com/etcd-io/etcd/pull/22025'
    label: security-advisories@github.com
  - url: 'https://github.com/etcd-io/etcd/releases/tag/v3.5.32'
    label: security-advisories@github.com
  - url: 'https://github.com/etcd-io/etcd/releases/tag/v3.6.13'
    label: security-advisories@github.com
  - url: 'https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92'
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59818.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-59818'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2498305'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-59818'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59818'
  - url: 'https://access.redhat.com/errata/RHSA-2026:44868'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.0043
epssPercentile: 0.34602
ingestedAt: '2026-07-13T15:27:34.375Z'
---

## Overview

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.

## Affected

- `etcd < 3.5.32`
- `etcd >= 3.6.0, < 3.6.13`

## Remediation

Upgrade past the affected range:

- `etcd 3.6.13`

## Vendor advisories

- **RHSA-2026:44868** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:44868)
- **Red Hat VEX** · Moderate · affected: Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 · no fix planned: Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59818.json)