CVE-2026-2808

Summary

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.

Affected Software

VendorProductVersion RangeStatus
HashiCorpConsul0 < 1.22.5affected
HashiCorpConsul Enterprise0 < 1.22.5affected

Weaknesses

  • CWE-59: CWE-59: Improper Link Resolution Before File Access (Link Following)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References