medium6.8
CVE-2026-2808
Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication
Impact
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/consul | < 1.18.21 | 1.18.21 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| HashiCorp | HashiCorp Consul And Consul Enterprise 1.18.20 | before 1.21.10 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.hashicorp.com/t/hcsec-2026-02-consul-vulnerable-to-arbitrary-file-reads-through-the-vault-kubernetes-authentication-provider/77232
- https://github.com/advisories/GHSA-cpfq-66p2-336j
- https://nvd.nist.gov/vuln/detail/CVE-2026-2808
- https://pkg.go.dev/vuln/GO-2026-4690