AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-cpfq-66p2-336j

Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication

Consul

CVE-2026-2808 · Published Mar 12, 2026 · updated Mar 24, 2026

Medium6.8
Fix: upgrade to 1.18.21 or later (3 fixed versions below)
GitHub advisory

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
< 1.18.211.18.21
>= 1.22.0-rc1, < 1.22.51.22.5
>= 1.19.0, < 1.21.111.21.11
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-59
Also known as
BIT-consul-2026-2808, CVE-2026-2808, GO-2026-4690

More Consul advisories

All Consul
Medium 6.5Oct 28, 2025Consul key/value endpoint is vulnerable to denial of serviceCVE-2025-11374fixed in 1.22.0Medium 6.5Oct 28, 2025Consul event endpoint is vulnerable to denial of serviceCVE-2025-11375fixed in 1.22.0Medium 8.3Oct 31, 2024Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerabilityCVE-2024-10006fixed in 1.20.1Medium 6.1Oct 31, 2024Hashicorp Consul Cross-site Scripting vulnerabilityCVE-2024-10086fixed in 1.20.0High 8.1Oct 31, 2024Hashicorp Consul Path Traversal vulnerabilityCVE-2024-10005fixed in 1.20.1Medium 6.5Jan 31, 2024Privilege Escalation in HashiCorp ConsulCVE-2020-28053fixed in 1.6.10 +2