Medium6.5Red Hat Linux

Medium [CVE-2026-59818] Authentication bypass due to improper Certificate Revocation List enforcement on gRPC listener

This medium-severity Red Hat Linux advisory covers CVE-2026-59818 affecting Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1.

CVE-2026-59818 Published Jul 8, 2026Updated by vendor Jul 8, 2026

CVE-2026-59818

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

etcd is a distributed key-value store for the data of a distributed system.

Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC.

This issue is fixed in versions 3.5.32 and 3.6.13. This oversight allows a client with a revoked certificate to successfully authenticate, potentially leading to unauthorized access and compromise of data integrity.

Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-295.

Affected Red Hat products: Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1. Red Hat does not currently list a fixing RHSA for this CVE.

Affected versions

< 3.5.32
< 3.6.13

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Fixed versions

3.5.32
3.6.13

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Mitigation

Upgrade to a fixed release: 3.5.32, 3.6.13. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.