CVE-2026-59818

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. This issue is fixed in versions 3.5.32 and 3.6.13.

• CWE-295

• https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1befPatch
• https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267fPatch
• https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbbPatch
• https://github.com/etcd-io/etcd/pull/22007Issue Tracking, Patch
• https://github.com/etcd-io/etcd/pull/22021Issue Tracking, Patch
• https://github.com/etcd-io/etcd/pull/22025Issue Tracking, Patch
• https://github.com/etcd-io/etcd/releases/tag/v3.5.32Product, Release Notes
• https://github.com/etcd-io/etcd/releases/tag/v3.6.13Product, Release Notes
• https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92Mitigation, Vendor Advisory

Published

Jul 8, 2026

Last Modified

Jul 13, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59804Midscene Bridge Server through 1.10.3, fixed in commit 86f41…7.6
• CVE-2026-59805Gumroad before 2026.07.06.2 contains a broken access control…7.1
• CVE-2026-59806Gradio before 6.20.0 contains an open redirect and server-si…7.4
• CVE-2026-59807Composio SDK before 0.2.32-beta.283 contains a path validati…8.9
• CVE-2026-5981A vulnerability has been found in D-Link DIR-605L 2.13B01. T…8.8
• CVE-2026-59817Ghost is a Node.js content management system. From 6.27.0 be…5.3
• CVE-2026-59819LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…4.9
• CVE-2026-5982A vulnerability was found in D-Link DIR-605L 2.13B01. This v…8.8
• CVE-2026-59820LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…6.5
• CVE-2026-59821LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…7.2
• CVE-2026-59822LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…8.2
• CVE-2026-59826Metabase is an open-source business intelligence and embedde…9.1