CVE-2026-59818
Fixed in a distro release EPSS <1%CVSS 6.5
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.
Products: etcd-io etcd
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | etcd-3.4 | no fix |
| Chainguard | py3-etcd | 0 |
| Chainguard | py3.10-etcd | 0 |
| Chainguard | py3.11-etcd | 0 |
| Chainguard | py3.12-etcd | 0 |
| Chainguard | py3.13-etcd | 0 |
| Debian 13 | etcd | no fix |
| Debian 14 | etcd | no fix |
| Red Hat hummingbird 1 | etcd | 0:3.7.1-0.1.hum1 |
| Ubuntu 16.04 LTS | etcd | no fix |
| Ubuntu 25.10 | etcd | no fix |
| Ubuntu 26.10 | etcd | no fix |
| Ubuntu Pro 18.04 LTS | etcd | no fix |
| Ubuntu Pro 20.04 LTS | etcd | no fix |
| Ubuntu Pro 22.04 LTS | etcd | no fix |
| Ubuntu Pro 24.04 LTS | etcd | no fix |
| Ubuntu Pro 26.04 LTS | etcd | no fix |
| Wolfi | py3-etcd | 0 |
| Wolfi | py3.10-etcd | 0 |
| Wolfi | py3.11-etcd | 0 |
| Wolfi | py3.12-etcd | 0 |
| Wolfi | py3.13-etcd | 0 |