{"id":"CVE-2026-59818","aliases":["AZL-92141","BELL-CVE-2026-59818","BIT-etcd-2026-59818","DEBIAN-CVE-2026-59818","EUVD-2026-42426","GHSA-3wh4-j44w-pg92","RHSA-2026:44868","UBUNTU-CVE-2026-59818"],"status":"published","title":"etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation","description":"etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0043,"percentile":0.37532,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-07-08T21:00:18Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"Azure Linux:3","package":"etcd","fixed_in":["3.5.33-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"etcd","fixed_in":["3.6.13-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"etcd","fixed_in":["3.5.32","3.6.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.33-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.4-r6"},{"fixed":"3.6.13-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"etcd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.32"},{"introduced":"3.6.0"},{"fixed":"3.6.13"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-10","3.5.16-11","3.5.16-4","3.5.16-5","3.5.16-6","3.5.16-7","3.5.16-8","3.5.16-9","3.5.22-1","3.5.22-2","3.5.30-1~exp1","3.5.30-1~exp2","3.5.30-2"]},{"source":"osv","ecosystem":"Debian:14","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-10","3.5.16-11","3.5.16-4","3.5.16-5","3.5.16-6","3.5.16-7","3.5.16-8","3.5.16-9","3.5.22-1","3.5.22-2","3.5.30-1~exp1","3.5.30-1~exp2","3.5.30-2"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.1-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0+dfsg-2","2.2.1+dfsg-1","2.2.2+dfsg-1","2.2.2+dfsg-2","2.2.3+dfsg-1","2.2.5+dfsg-1","2.2.5+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-1","3.2.9+dfsg-2","3.2.9+dfsg-3","3.2.17+dfsg-1","3.2.17+dfsg-1ubuntu0.1~esm1","3.2.17+dfsg-1ubuntu0.1","3.2.17+dfsg-1ubuntu0.1+esm1","3.2.17+dfsg-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.26+dfsg-3","3.2.26+dfsg-4","3.2.26+dfsg-6","3.2.26+dfsg-6ubuntu0.1","3.2.26+dfsg-6ubuntu0.2","3.2.26+dfsg-6ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.25+dfsg-6","3.3.25+dfsg-7","3.3.25+dfsg-7ubuntu0.22.04.1","3.3.25+dfsg-7ubuntu0.22.04.1+esm1","3.3.25+dfsg-7ubuntu0.22.04.2","3.3.25+dfsg-7ubuntu0.22.04.2+esm1","3.3.25+dfsg-7ubuntu0.22.04.2+esm2","3.3.25+dfsg-7ubuntu0.22.04.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.23-4ubuntu2","3.4.30-1","3.4.30-1build1","3.4.30-1ubuntu0.24.04.1","3.4.30-1ubuntu0.24.04.2","3.4.30-1ubuntu0.24.04.2+esm1","3.4.30-1ubuntu0.24.04.3","3.4.30-1ubuntu0.24.04.3+esm1","3.4.30-1ubuntu0.24.04.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-10","3.5.30-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-4","3.5.16-10","3.5.16-10ubuntu0.26.04.1~esm1"]}],"products":[{"vendor":"etcd","product":"etcd"},{"vendor":"etcd-io","product":"etcd"}],"references":[{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/etcd-io/etcd/pull/22007","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","article","report"]},{"url":"https://github.com/etcd-io/etcd/pull/22021","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","article","report"]},{"url":"https://github.com/etcd-io/etcd/pull/22025","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","article","report"]},{"url":"https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://github.com/etcd-io/etcd/releases/tag/v3.5.32","tags":["x_refsource_MISC","Product","Release Notes","article","web","report"]},{"url":"https://github.com/etcd-io/etcd/releases/tag/v3.6.13","tags":["x_refsource_MISC","Product","Release Notes","article","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59818","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-59818","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59818.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59818","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44868","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73500","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59818","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44283","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44868.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477527","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44283","tags":["advisory"]},{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59818","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515007","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73500","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73500","tags":["advisory"]},{"url":"https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2","tags":["article"]},{"url":"https://github.com/etcd-io/etcd/commit/89ff6d50796049d4f1136915ba21504b76e7e372","tags":["article"]},{"url":"https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3","tags":["article"]},{"url":"https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057","tags":["article"]},{"url":"https://github.com/etcd-io/etcd/pull/22130","tags":["article"]},{"url":"https://github.com/etcd-io/etcd/releases/tag/v3.5.33","tags":["article"]},{"url":"https://github.com/etcd-io/etcd/releases/tag/v3.6.14","tags":["article"]},{"url":"https://github.com/etcd-io/etcd/releases/tag/v3.7.1","tags":["article"]},{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-59818","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-59818","title":"etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation","description":"etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.","status":"published","published":"2026-07-08T21:00:18.207Z","modified":"2026-07-09T13:13:10.463Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-42426","description":"etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.","status":"published","published":"2026-07-08T21:00:18Z","modified":"2026-07-09T13:13:10Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:04.523855Z"}],"nvd":[{"id":"CVE-2026-59818","description":"etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.","status":"published","published":"2026-07-08T21:16:54.503Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"BELL-CVE-2026-59818","status":"published","published":"2026-07-11T06:04:33.759298Z","modified":"2026-09-24T07:15:04.266888425Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-59818","title":"etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation","description":"etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.","status":"published","published":"2026-07-08T21:00:18.207Z","modified":"2026-10-28T02:30:20.556450659Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DEBIAN-CVE-2026-59818","description":"etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.","status":"published","published":"2026-07-08T21:16:54.503Z","modified":"2026-10-26T11:47:32.733349662Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"RHSA-2026:44868","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-09T10:15:41Z","modified":"2026-10-16T10:18:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"UBUNTU-CVE-2026-59818","description":"etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.","status":"published","published":"2026-07-08T21:16:00Z","modified":"2026-10-17T13:00:29.232436874Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-92141","title":"CVE-2026-59818 affecting package etcd for versions less than 3.5.33-1","description":"etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.","status":"published","published":"2026-07-08T21:16:54Z","modified":"2026-08-28T17:56:59.103168Z","updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"BIT-etcd-2026-59818","title":"etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation","description":"etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.","status":"published","published":"2026-07-14T15:42:36.975Z","modified":"2026-09-08T08:47:05.761011877Z","updated_at":"2026-11-02T15:28:29.563843Z"}]}}