Moderate severityNVD Advisory· Published Mar 11, 2026· Updated Apr 17, 2026
Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider
CVE-2026-2808
Description
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/hashicorp/consulGo | < 1.18.21 | 1.18.21 |
github.com/hashicorp/consulGo | >= 1.22.0-rc1, < 1.22.5 | 1.22.5 |
github.com/hashicorp/consulGo | >= 1.19.0, < 1.21.11 | 1.21.11 |
Affected products
5- osv-coords3 versionspkg:bitnami/consulpkg:golang/github.com/hashicorp/consulpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
< 1.22.5+ 2 more
- (no CPE)range: < 1.22.5
- (no CPE)range: < 1.18.21
- (no CPE)range: < 0.0.20260317T205859-150000.1.152.1
- Range: 0
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.