8.1

CVE-2026-59818: etcd-io etcd Improper Certificate Validation

CVSS: 8.1v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-59818DEBIAN-CVE-2026-59818CGA-3pq5-5h4m-3h9x
Published 08-07-2026Last modified 09-07-2026
Open JSON

Vulnerability summary

CVE-2026-59818 is a high (CVSS 8.1) Improper Certificate Validation vulnerability in etcd-io etcd. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.7% of scored vulnerabilities.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (NVD)
EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
RHSA-2026:44868CGA-59MF-X6PP-9M2H

Timeline

  1. 08-07-2026
    PublishedVulnerability first disclosed.
  2. 09-07-2026
    Last modifiedVulnerability information updated.

Description

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

0.00 pp

From 0.43% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard6 products
  • etcd-3.4All versions (No fix recorded)
  • py3-etcdAll versions (No fix recorded)
  • py3.10-etcdAll versions (No fix recorded)
  • py3.11-etcdAll versions (No fix recorded)
  • py3.12-etcdAll versions (No fix recorded)
Wolfi5 products
  • py3-etcdAll versions (No fix recorded)
  • py3.10-etcdAll versions (No fix recorded)
  • py3.11-etcdAll versions (No fix recorded)
  • py3.12-etcdAll versions (No fix recorded)
  • py3.13-etcdAll versions (No fix recorded)
Debian1 product
  • etcdAll versions (No fix recorded)
Etcd1 product
  • etcd< 3.5.32 | ≥ 3.6.0, < 3.6.13
Etcd-io1 product
  • etcd≥ 3.6.0-alpha.0, < 3.6.13 | < 3.5.32
Ubuntu1 product
  • etcdAll versions (No fix recorded)

6 vendors · 15 products

References

14 links
Show all 14 references