TI-2026-15918 Aliases CVE-2026-19589 GHSA-3cf4-f9v4-j353

Packer vulnerable to arbitrary file write via crafted plugin archive during installation

LOW 31CWE-22Published 2026-08-17 · Updated 2026-08-17

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00194 9th percentileScored 2026-11-07

Fix Fixed Packer (HashiCorp): 1.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HashiCorp	Packer	1.7.0 to before 1.16.0	1.16.0	Patch available	CNA

Packer VendorHashiCorp Affected 1.7.0 to before 1.16.0 Fixed in 1.16.0 Patch available CNA

Remediation

Fix · CNA Packer (HashiCorp) Fixed in 1.16.0

Timeline

2026-10-02 Threatist record created from CVE-2026-19589
2026-10-03 Alias added: GHSA-3cf4-f9v4-j353

References

Other 1

https://discuss.hashicorp.com/t/hcsec-2026-29-packer-vulnerable-to-arbitrary-file-write-via-crafted-plugin-archive-during-installation/77654

TI-2024-01904 Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates CVSS 3.1CRITICAL 9.8
TI-2021-18437 HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4… CVSS 3.1HIGH 8.8
TI-2026-06570 Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution CVSS 3.1HIGH 8.8
TI-2020-17753 The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root… CVSS 3.1CRITICAL 9.8
TI-2026-13641 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVSS 3.1CRITICAL 10.0
TI-2026-13778 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVSS 3.1CRITICAL 10.0

See all 246 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences