diff --git a/build/build-image/cross/Dockerfile b/build/build-image/cross/Dockerfile
index ac38a5432d8..2134ab312b4 100644
--- a/build/build-image/cross/Dockerfile
+++ b/build/build-image/cross/Dockerfile
@@ -71,7 +71,7 @@ RUN go get golang.org/x/tools/cmd/cover \
             golang.org/x/tools/cmd/goimports
 
 # Download and symlink etcd. We need this for our integration tests.
-RUN export ETCD_VERSION=v3.2.18; \
+RUN export ETCD_VERSION=v3.2.24; \
   mkdir -p /usr/local/src/etcd \
   && cd /usr/local/src/etcd \
   && curl -fsSL https://github.com/coreos/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-amd64.tar.gz | tar -xz \
diff --git a/build/root/WORKSPACE b/build/root/WORKSPACE
index 01ca4971d6a..23a59acbf68 100644
--- a/build/root/WORKSPACE
+++ b/build/root/WORKSPACE
@@ -21,12 +21,12 @@ http_archive(
     urls = mirror("https://github.com/bazelbuild/bazel-skylib/archive/2169ae1c374aab4a09aa90e65efe1a3aad4e279b.tar.gz"),
 )
 
-ETCD_VERSION = "3.2.18"
+ETCD_VERSION = "3.2.24"
 
 new_http_archive(
     name = "com_coreos_etcd",
     build_file = "third_party/etcd.BUILD",
-    sha256 = "b729db0732448064271ea6fdcb901773c4fe917763ca07776f22d0e5e0bd4097",
+    sha256 = "947849dbcfa13927c81236fb76a7c01d587bbab42ab1e807184cd91b026ebed7",
     strip_prefix = "etcd-v%s-linux-amd64" % ETCD_VERSION,
     urls = mirror("https://github.com/coreos/etcd/releases/download/v%s/etcd-v%s-linux-amd64.tar.gz" % (ETCD_VERSION, ETCD_VERSION)),
 )
diff --git a/cluster/gce/config-test.sh b/cluster/gce/config-test.sh
index e3a8165b30e..a1bd2d8fc36 100755
--- a/cluster/gce/config-test.sh
+++ b/cluster/gce/config-test.sh
@@ -176,7 +176,7 @@ ENABLE_METADATA_AGENT="${KUBE_ENABLE_METADATA_AGENT:-none}"
 # Useful for scheduling heapster in large clusters with nodes of small size.
 HEAPSTER_MACHINE_TYPE="${HEAPSTER_MACHINE_TYPE:-}"
 
-# Set etcd image (e.g. k8s.gcr.io/etcd) and version (e.g. 3.2.18-0) if you need
+# Set etcd image (e.g. k8s.gcr.io/etcd) and version (e.g. 3.2.24-0) if you need
 # non-default version.
 ETCD_IMAGE="${TEST_ETCD_IMAGE:-}"
 ETCD_DOCKER_REPOSITORY="${TEST_ETCD_DOCKER_REPOSITORY:-}"
diff --git a/cluster/gce/manifests/etcd-empty-dir-cleanup.yaml b/cluster/gce/manifests/etcd-empty-dir-cleanup.yaml
index 9b92d6f40bf..d3be590a888 100644
--- a/cluster/gce/manifests/etcd-empty-dir-cleanup.yaml
+++ b/cluster/gce/manifests/etcd-empty-dir-cleanup.yaml
@@ -14,4 +14,4 @@ spec:
   dnsPolicy: Default
   containers:
   - name: etcd-empty-dir-cleanup
-    image: k8s.gcr.io/etcd-empty-dir-cleanup:3.2.18.0
+    image: k8s.gcr.io/etcd-empty-dir-cleanup:3.2.24.0
diff --git a/cluster/gce/manifests/etcd.manifest b/cluster/gce/manifests/etcd.manifest
index 194ba765526..71a811dbb6d 100644
--- a/cluster/gce/manifests/etcd.manifest
+++ b/cluster/gce/manifests/etcd.manifest
@@ -14,7 +14,7 @@
 "containers":[
     {
     "name": "etcd-container",
-    "image": "{{ pillar.get('etcd_docker_repository', 'k8s.gcr.io/etcd') }}:{{ pillar.get('etcd_docker_tag', '3.2.18-0') }}",
+    "image": "{{ pillar.get('etcd_docker_repository', 'k8s.gcr.io/etcd') }}:{{ pillar.get('etcd_docker_tag', '3.2.24-0') }}",
     "resources": {
       "requests": {
         "cpu": {{ cpulimit }}
@@ -30,7 +30,7 @@
         "value": "{{ pillar.get('storage_backend', 'etcd3') }}"
       },
       { "name": "TARGET_VERSION",
-        "value": "{{ pillar.get('etcd_version', '3.2.18') }}"
+        "value": "{{ pillar.get('etcd_version', '3.2.24') }}"
       },
       { "name": "DATA_DIRECTORY",
         "value": "/var/etcd/data{{ suffix }}"
diff --git a/cluster/gce/upgrade-aliases.sh b/cluster/gce/upgrade-aliases.sh
index cc6fcb0aea3..2c3df6c90a6 100755
--- a/cluster/gce/upgrade-aliases.sh
+++ b/cluster/gce/upgrade-aliases.sh
@@ -161,8 +161,8 @@ export KUBE_GCE_ENABLE_IP_ALIASES=true
 export SECONDARY_RANGE_NAME="pods-default"
 export STORAGE_BACKEND="etcd3"
 export STORAGE_MEDIA_TYPE="application/vnd.kubernetes.protobuf"
-export ETCD_IMAGE=3.2.18-0
-export ETCD_VERSION=3.2.18
+export ETCD_IMAGE=3.2.24-0
+export ETCD_VERSION=3.2.24
 
 # Upgrade master with updated kube envs
 ${KUBE_ROOT}/cluster/gce/upgrade.sh -M -l
diff --git a/cluster/images/etcd-empty-dir-cleanup/Makefile b/cluster/images/etcd-empty-dir-cleanup/Makefile
index 9e09a538ae1..c2b86977968 100644
--- a/cluster/images/etcd-empty-dir-cleanup/Makefile
+++ b/cluster/images/etcd-empty-dir-cleanup/Makefile
@@ -14,13 +14,13 @@
 
 .PHONY:	build push
 
-ETCD_VERSION = 3.2.18
+ETCD_VERSION = 3.2.24
 # Image should be pulled from k8s.gcr.io, which will auto-detect
 # region (us, eu, asia, ...) and pull from the closest.
 REGISTRY = k8s.gcr.io
 # Images should be pushed to staging-k8s.gcr.io.
 PUSH_REGISTRY = staging-k8s.gcr.io
-TAG = 3.2.18.0
+TAG = 3.2.24.0
 
 clean:
 	rm -rf etcdctl etcd-v$(ETCD_VERSION)-linux-amd64 etcd-v$(ETCD_VERSION)-linux-amd64.tar.gz
diff --git a/cluster/images/etcd/Makefile b/cluster/images/etcd/Makefile
index bf9d13a8c07..93f9e50a9a9 100644
--- a/cluster/images/etcd/Makefile
+++ b/cluster/images/etcd/Makefile
@@ -15,7 +15,7 @@
 # Build the etcd image
 #
 # Usage:
-# 	[BUNDLED_ETCD_VERSIONS=2.2.1 2.3.7 3.0.17 3.1.12 3.2.18] [REGISTRY=k8s.gcr.io] [ARCH=amd64] [BASEIMAGE=busybox] make (build|push)
+# 	[BUNDLED_ETCD_VERSIONS=2.2.1 2.3.7 3.0.17 3.1.12 3.2.18 3.2.24] [REGISTRY=k8s.gcr.io] [ARCH=amd64] [BASEIMAGE=busybox] make (build|push)
 #
 # The image contains different etcd versions to simplify
 # upgrades. Thus be careful when removing any versions from here.
@@ -26,10 +26,10 @@
 # Except from etcd-$(version) and etcdctl-$(version) binaries, we also
 # need etcd and etcdctl binaries for backward compatibility reasons.
 # That binary will be set to the last version from $(BUNDLED_ETCD_VERSIONS).
-BUNDLED_ETCD_VERSIONS?=2.2.1 2.3.7 3.0.17 3.1.12 3.2.18
+BUNDLED_ETCD_VERSIONS?=2.2.1 2.3.7 3.0.17 3.1.12 3.2.18 3.2.24
 
 # LATEST_ETCD_VERSION identifies the most recent etcd version available.
-LATEST_ETCD_VERSION?=3.2.18
+LATEST_ETCD_VERSION?=3.2.24
 
 # REVISION provides a version number fo this image and all it's bundled
 # artifacts. It should start at zero for each LATEST_ETCD_VERSION and increment
diff --git a/cluster/images/etcd/README.md b/cluster/images/etcd/README.md
index 6ba178a626e..ec92698b77c 100644
--- a/cluster/images/etcd/README.md
+++ b/cluster/images/etcd/README.md
@@ -26,7 +26,7 @@ server.
 
 `migrate` writes a `version.txt` file to track the "current" version
 of etcd that was used to persist data to disk. A "target" version may also be provided
-by the `TARGET_STORAGE` (e.g. "etcd3") and `TARGET_VERSION` (e.g. "3.2.11" )
+by the `TARGET_STORAGE` (e.g. "etcd3") and `TARGET_VERSION` (e.g. "3.2.24" )
 environment variables. If the persisted version differs from the target version,
 `migrate-if-needed.sh` will migrate the data from the current to the target
 version.
diff --git a/cluster/images/etcd/migrate-if-needed.sh b/cluster/images/etcd/migrate-if-needed.sh
index 79c832f7e7c..a40e6592962 100755
--- a/cluster/images/etcd/migrate-if-needed.sh
+++ b/cluster/images/etcd/migrate-if-needed.sh
@@ -18,7 +18,7 @@
 # This script performs etcd upgrade based on the following environmental
 # variables:
 # TARGET_STORAGE - API of etcd to be used (supported: 'etcd2', 'etcd3')
-# TARGET_VERSION - etcd release to be used (supported: '2.2.1', '2.3.7', '3.0.17', '3.1.12', '3.2.18')
+# TARGET_VERSION - etcd release to be used (supported: '2.2.1', '2.3.7', '3.0.17', '3.1.12', '3.2.18', '3.2.24')
 # DATA_DIRECTORY - directory with etcd data
 #
 # The current etcd version and storage format is detected based on the
@@ -30,6 +30,7 @@
 # - 2.3.7/etcd2 -> 3.0.17/etcd2
 # - 3.0.17/etcd3 -> 3.1.12/etcd3
 # - 3.1.12/etcd3 -> 3.2.18/etcd3
+# - 3.2.18/etcd3 -> 3.2.24/etcd3
 #
 # NOTE: The releases supported in this script has to match release binaries
 # present in the etcd image (to make this script work correctly).
@@ -42,7 +43,7 @@ set -o nounset
 
 # NOTE: BUNDLED_VERSION has to match release binaries present in the
 # etcd image (to make this script work correctly).
-BUNDLED_VERSIONS="2.2.1, 2.3.7, 3.0.17, 3.1.12, 3.2.18"
+BUNDLED_VERSIONS="2.2.1, 2.3.7, 3.0.17, 3.1.12, 3.2.18 3.2.24"
 
 ETCD_NAME="${ETCD_NAME:-etcd-$(hostname)}"
 if [ -z "${DATA_DIRECTORY:-}" ]; then
diff --git a/cmd/kubeadm/app/constants/constants.go b/cmd/kubeadm/app/constants/constants.go
index e3785526351..f8dc6dea91b 100644
--- a/cmd/kubeadm/app/constants/constants.go
+++ b/cmd/kubeadm/app/constants/constants.go
@@ -241,10 +241,10 @@ const (
 	KubeletHealthzPort = 10248
 
 	// MinExternalEtcdVersion indicates minimum external etcd version which kubeadm supports
-	MinExternalEtcdVersion = "3.2.17"
+	MinExternalEtcdVersion = "3.2.18"
 
 	// DefaultEtcdVersion indicates the default etcd version that kubeadm uses
-	DefaultEtcdVersion = "3.2.18"
+	DefaultEtcdVersion = "3.2.24"
 
 	// Etcd defines variable used internally when referring to etcd component
 	Etcd = "etcd"
@@ -361,7 +361,7 @@ var (
 	SupportedEtcdVersion = map[uint8]string{
 		10: "3.1.12",
 		11: "3.2.18",
-		12: "3.2.18",
+		12: "3.2.24",
 	}
 )
 
diff --git a/cmd/kubeadm/app/constants/constants_test.go b/cmd/kubeadm/app/constants/constants_test.go
index f2bdd5ae9a9..317406f0fb0 100644
--- a/cmd/kubeadm/app/constants/constants_test.go
+++ b/cmd/kubeadm/app/constants/constants_test.go
@@ -170,7 +170,7 @@ func TestEtcdSupportedVersion(t *testing.T) {
 		},
 		{
 			kubernetesVersion: "1.12.1",
-			expectedVersion:   version.MustParseSemantic("3.2.18"),
+			expectedVersion:   version.MustParseSemantic("3.2.24"),
 			expectedError:     nil,
 		},
 	}
diff --git a/cmd/kubeadm/app/phases/upgrade/compute_test.go b/cmd/kubeadm/app/phases/upgrade/compute_test.go
index b2983d84f3e..7c7e474f89f 100644
--- a/cmd/kubeadm/app/phases/upgrade/compute_test.go
+++ b/cmd/kubeadm/app/phases/upgrade/compute_test.go
@@ -589,7 +589,7 @@ func TestGetAvailableUpgrades(t *testing.T) {
 						KubeadmVersion: "v1.12.0-alpha.2",
 						DNSType:        "coredns",
 						DNSVersion:     "1.2.2",
-						EtcdVersion:    "3.2.18",
+						EtcdVersion:    "3.2.24",
 					},
 				},
 			},
@@ -642,7 +642,7 @@ func TestGetAvailableUpgrades(t *testing.T) {
 						KubeadmVersion: "v1.12.1",
 						DNSType:        "coredns",
 						DNSVersion:     "1.2.2",
-						EtcdVersion:    "3.2.18",
+						EtcdVersion:    "3.2.24",
 					},
 				},
 			},
@@ -679,7 +679,7 @@ func TestGetAvailableUpgrades(t *testing.T) {
 						KubeadmVersion: "v1.12.0",
 						DNSType:        "coredns",
 						DNSVersion:     "1.2.2",
-						EtcdVersion:    "3.2.18",
+						EtcdVersion:    "3.2.24",
 					},
 				},
 			},
@@ -716,7 +716,7 @@ func TestGetAvailableUpgrades(t *testing.T) {
 						KubeadmVersion: "v1.12.0",
 						DNSType:        "kube-dns",
 						DNSVersion:     "1.14.10",
-						EtcdVersion:    "3.2.18",
+						EtcdVersion:    "3.2.24",
 					},
 				},
 			},
diff --git a/hack/lib/etcd.sh b/hack/lib/etcd.sh
index de49055a815..33d8e07a988 100755
--- a/hack/lib/etcd.sh
+++ b/hack/lib/etcd.sh
@@ -16,7 +16,7 @@
 
 # A set of helpers for starting/running etcd for tests
 
-ETCD_VERSION=${ETCD_VERSION:-3.2.18}
+ETCD_VERSION=${ETCD_VERSION:-3.2.24}
 ETCD_HOST=${ETCD_HOST:-127.0.0.1}
 ETCD_PORT=${ETCD_PORT:-2379}
 export KUBE_INTEGRATION_ETCD_URL="http://${ETCD_HOST}:${ETCD_PORT}"
diff --git a/staging/src/k8s.io/apiextensions-apiserver/artifacts/example/rc.yaml b/staging/src/k8s.io/apiextensions-apiserver/artifacts/example/rc.yaml
index 86b5d3070a9..b42d8508297 100644
--- a/staging/src/k8s.io/apiextensions-apiserver/artifacts/example/rc.yaml
+++ b/staging/src/k8s.io/apiextensions-apiserver/artifacts/example/rc.yaml
@@ -23,4 +23,4 @@ spec:
         - "--etcd-servers=http://localhost:2379"
         - "--audit-log-path=-"
       - name: etcd
-        image: quay.io/coreos/etcd:v3.2.18
+        image: quay.io/coreos/etcd:v3.2.24
diff --git a/staging/src/k8s.io/sample-apiserver/artifacts/example/rc.yaml b/staging/src/k8s.io/sample-apiserver/artifacts/example/rc.yaml
index ba2f4162a7b..9513a849484 100644
--- a/staging/src/k8s.io/sample-apiserver/artifacts/example/rc.yaml
+++ b/staging/src/k8s.io/sample-apiserver/artifacts/example/rc.yaml
@@ -21,4 +21,4 @@ spec:
         imagePullPolicy: Never
         command: [ "/kube-sample-apiserver", "--etcd-servers=http://localhost:2379" ]
       - name: etcd
-        image: quay.io/coreos/etcd:v3.2.18
+        image: quay.io/coreos/etcd:v3.2.24
diff --git a/test/e2e/apimachinery/aggregator.go b/test/e2e/apimachinery/aggregator.go
index 63addc8e431..173b6f56180 100644
--- a/test/e2e/apimachinery/aggregator.go
+++ b/test/e2e/apimachinery/aggregator.go
@@ -133,7 +133,7 @@ func TestSampleAPIServer(f *framework.Framework, image string) {
 
 	// kubectl create -f deploy.yaml
 	deploymentName := "sample-apiserver-deployment"
-	etcdImage := "quay.io/coreos/etcd:v3.2.18"
+	etcdImage := "quay.io/coreos/etcd:v3.2.24"
 	podLabels := map[string]string{"app": "sample-apiserver", "apiserver": "true"}
 	replicas := int32(1)
 	zero := int64(0)
diff --git a/test/e2e/framework/nodes_util.go b/test/e2e/framework/nodes_util.go
index a58a6e62859..6b8ffeb7c11 100644
--- a/test/e2e/framework/nodes_util.go
+++ b/test/e2e/framework/nodes_util.go
@@ -63,7 +63,7 @@ func etcdUpgradeGCE(target_storage, target_version string) error {
 		os.Environ(),
 		"TEST_ETCD_VERSION="+target_version,
 		"STORAGE_BACKEND="+target_storage,
-		"TEST_ETCD_IMAGE=3.2.18-0")
+		"TEST_ETCD_IMAGE=3.2.24-0")
 
 	_, _, err := RunCmdEnv(env, gceUpgradeScript(), "-l", "-M")
 	return err
@@ -103,7 +103,7 @@ func masterUpgradeGCE(rawV string, enableKubeProxyDaemonSet bool) error {
 		env = append(env,
 			"TEST_ETCD_VERSION="+TestContext.EtcdUpgradeVersion,
 			"STORAGE_BACKEND="+TestContext.EtcdUpgradeStorage,
-			"TEST_ETCD_IMAGE=3.2.18-0")
+			"TEST_ETCD_IMAGE=3.2.24-0")
 	} else {
 		// In e2e tests, we skip the confirmation prompt about
 		// implicit etcd upgrades to simulate the user entering "y".
diff --git a/test/kubemark/start-kubemark.sh b/test/kubemark/start-kubemark.sh
index a0233f5effa..39784517dda 100755
--- a/test/kubemark/start-kubemark.sh
+++ b/test/kubemark/start-kubemark.sh
@@ -64,7 +64,7 @@ SERVICE_CLUSTER_IP_RANGE="${SERVICE_CLUSTER_IP_RANGE:-}"
 EVENT_PD="${EVENT_PD:-}"
 
 # Etcd related variables.
-ETCD_IMAGE="${ETCD_IMAGE:-3.2.18-0}"
+ETCD_IMAGE="${ETCD_IMAGE:-3.2.24-0}"
 ETCD_VERSION="${ETCD_VERSION:-}"
 
 # Controller-manager related variables.