Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication

MEDIUM 6.8CVE-2026-2808 · BIT-consul-2026-2808 · GHSA-cpfq-66p2-336j · Published 12/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/hashicorp/consul Go	`≥ 1.19.0, < 1.21.11≥ 1.22.0-rc1, < 1.22.5< 1.18.21< 1.22.5`	`1.21.111.22.51.18.21`

Description

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-2808 · ADVISORY
discuss.hashicorp.com/t/hcsec-2026-02-consul-vulnerable-to-arbitrary-file-reads-through-the-vault-kubernetes-authentication-provider/77232 · WEB
hashicorp/consul · PACKAGE
pkg.go.dev/vuln/GO-2026-4690 · WEB
GitHub Advisory GHSA-cpfq-66p2-336j · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free