CVE-2026-2808 Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider
Attackers can read arbitrary files from the server when Consul is configured with Kubernetes authentication, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2808?
CVE-2026-2808 is a medium-severity path traversal vulnerability in HashiCorp Consul, published on 11 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.
Weakness: CWE-59
Which versions are affected by CVE-2026-2808?
8 open source packages ship an affected version, including github.com/hashicorp/consul and consul.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/consul Go | All versions | 1.18.21 |
github.com/hashicorp/consul Go | All versions | 1.18.21 |
github.com/hashicorp/consul Go | All versions | 1.22.5 |
github.com/hashicorp/consul Go | From 1.19.0 | 1.21.11 |
github.com/hashicorp/consul Go | From 1.19.0 | 1.21.11 |
github.com/hashicorp/consul Go | From 1.22.0-rc1 | 1.22.5 |
2 more packages
github.com/hashicorp/consul Go | From 1.22.0-rc1 | 1.22.5 |
consul Bitnami | All versions | 1.22.5 |
Linux distribution packages (2)
golang-github-docker-libnetwork SUSE:Linux Enterprise Micro 5.3 | All versions | 0.7.0.1+gitr2908_55e924b8-150000.4.34.1 |
golang-github-docker-libnetwork SUSE:Linux Enterprise Micro 5.4 | All versions | 0.7.0.1+gitr2908_55e924b8-150000.4.34.1 |
How do I fix CVE-2026-2808?
Upgrade github.com/hashicorp/consul to a fixed version for your release line: 1.18.21, 1.22.5 or 1.21.11.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-2808 being exploited?
There is no known exploitation of CVE-2026-2808 in the wild and no public exploit code.
Sources
Also known as BIT-consul-2026-2808, DEBIAN-CVE-2026-2808, GHSA-cpfq-66p2-336j, GO-2026-4690, SUSE-SU-2026:2740-1, UBUNTU-CVE-2026-2808.