Read the docs
TI-2026-42635 Aliases CVE-2026-59818

etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation

Priority LOW 38CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-295.

Summary

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Fix Partial etcd (etcd-io): 3.6.13, 3.5.32Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
etcd-ioetcd3.6.0-alpha.0 to before 3.6.13; before 3.5.323.6.13, 3.5.32Patch availableCNA
  • etcd Vendoretcd-io Affected 3.6.0-alpha.0 to before 3.6.13; before 3.5.32 Fixed in 3.6.13, 3.5.32 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:*before 3.5.32; 3.6.0 to before 3.6.13Vulnerableetcd-io
  • cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:* Versions before 3.5.32; 3.6.0 to before 3.6.13 Vulnerable ·etcd-io

Remediation

  • Fix · CNA etcd (etcd-io) Fixed in 3.6.13, 3.5.32

Red Hat 1 advisory

  • RHSA-2026:44868 Released 2026-07-24 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images etcd-3.7.1-0.1.hum1@aarch64, etcd-3.7.1-0.1.hum1@src, etcd-3.7.1-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 16.2AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 17.1AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:44868

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59818

References

Patch 6

Advisory 1

Other 2

  • TI-2021-09444 Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2026-25810 etcd: Authorization bypasses in multiple APIs CVSS 4.0HIGH 8.8
  • TI-2022-15016 Etcd v3.5.4 allows remote attackers to cause a denial of service via function… CVSS 3.1HIGH 7.5
  • TI-2018-12096 Improper authentication in etcd: CVSS 3.1HIGH 8.1
  • TI-2026-25749 etcd: Nested etcd transactions bypass RBAC authorization checks CVSS 3.1MEDIUM 6.5
  • TI-2020-11888 Improper Preservation of Permissions in etcd CVSS 3.1HIGH 7.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences