CVE-2026-2808 — Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider

CVE-2026-2808

Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider PUBLISHED

Description (CNA)

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Consul	affected 0 before 1.22.5
HashiCorp / Consul Enterprise	affected 0 before 1.22.5

CWE

CWE-59

References

https://discuss.hashicorp.com/t/hcsec-2026-02-consul-vulnerable-to-arbitrary-file-reads-through-the-vault-kubernetes-authentication-provider/77232

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.