CVE-2026-59818

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.5.32 etcd versions prior to 3.6.13

Description etcd is a distributed key-value store for the data of a distributed system. When configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List (a list of digital certificates that have been revoked by the issuing certificate authority before their scheduled expiration date) is not enforced on the gRPC listener. This allows a client with a revoked certificate to authenticate successfully over gRPC.

Recommendations Update to version 3.5.32. Update to version 3.6.13.