GHSA-cpfq-66p2-336j
Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/consul | < 1.18.21 | 1.18.21 |
| Go | github.com/hashicorp/consul | >= 1.22.0-rc1, < 1.22.5 | 1.22.5 |
| Go | github.com/hashicorp/consul | >= 1.19.0, < 1.21.11 | 1.21.11 |
Details
As written in the advisory (Markdown source, shown as plain text).
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.
References
External links from the advisory. They lead to third-party sites.