CVE-2026-59818CWE-295

etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation

Medium · published July 8, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-07-08T21:00Z
EPSS history
Timeline
  • 08 JUL 21:00Z
    etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
    cvelistv5