Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider
Priority LOW 31CWE-59Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-59 and the CVSS impact.
Summary
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00539 45th percentileScored 2026-11-07
Fix Fixed Consul (HashiCorp): 1.22.5Consul Enterprise (HashiCorp): 1.22.5+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HashiCorp | Consul | before 1.22.5 | 1.22.5 | Patch available | CNA |
| HashiCorp | Consul Enterprise | before 1.22.5 | 1.22.5 | Patch available | CNA |
| — | github.com/hashicorp/consul (Go) | before 1.18.21 | 1.18.21 | Patch available | GHSA-cpfq-66p2-336j |
| — | github.com/hashicorp/consul (Go) | 1.22.0-rc1 to before 1.22.5 | 1.22.5 | Patch available | GHSA-cpfq-66p2-336j |
| — | github.com/hashicorp/consul (Go) | 1.19.0 to before 1.21.11 | 1.21.11 | Patch available | GHSA-cpfq-66p2-336j |
- Consul VendorHashiCorp Affected before 1.22.5 Fixed in 1.22.5 Patch available CNA
- Consul Enterprise VendorHashiCorp Affected before 1.22.5 Fixed in 1.22.5 Patch available CNA
- github.com/hashicorp/consul (Go) Vendor— Affected before 1.18.21 Fixed in 1.18.21 Patch available GHSA-cpfq-66p2-336j
- github.com/hashicorp/consul (Go) Vendor— Affected 1.22.0-rc1 to before 1.22.5 Fixed in 1.22.5 Patch available GHSA-cpfq-66p2-336j
- github.com/hashicorp/consul (Go) Vendor— Affected 1.19.0 to before 1.21.11 Fixed in 1.21.11 Patch available GHSA-cpfq-66p2-336j
Remediation
- Fix · CNA Consul (HashiCorp) Fixed in 1.22.5
- Fix · CNA Consul Enterprise (HashiCorp) Fixed in 1.22.5
- Fix · GHSA-cpfq-66p2-336j github.com/hashicorp/consul (Go) Fixed in 1.18.21 Advisory →
- Fix · GHSA-cpfq-66p2-336j github.com/hashicorp/consul (Go) Fixed in 1.22.5 Advisory →
- Fix · GHSA-cpfq-66p2-336j github.com/hashicorp/consul (Go) Fixed in 1.21.11 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 14 products
- Logging Subsystem for Red Hat OpenShift
- Multicluster Global Hub
- OpenShift Serverless
- OpenShift Service Mesh 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2
- Red Hat Edge Manager 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift GitOps
- Red Hat OpenShift distributed tracing 3
- Red Hat OpenStack Platform 18.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2808
- 2026-10-03 Alias added: GHSA-cpfq-66p2-336j
References
More HashiCorp vulnerabilities
- TI-2024-01904 Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates CVSS 3.1CRITICAL 9.8
- TI-2021-18437 HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4… CVSS 3.1HIGH 8.8
- TI-2026-06570 Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution CVSS 3.1HIGH 8.8
- TI-2020-17753 The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root… CVSS 3.1CRITICAL 9.8
- TI-2026-13641 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVSS 3.1CRITICAL 10.0
- TI-2026-13778 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-2808 · CVE Program
- CVE-2026-2808 · NVD
- FIRST EPSS
- GHSA-cpfq-66p2-336j · GitHub Advisory Database · CC BY 4.0
- CVE-2026-2808 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences