GHSA-cpfq-66p2-336j BIT-consul-2026-2808 CVE-2026-2808 GO-2026-4690
Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication
- Severity
- 6.8 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.50%
- Chance of exploitation in the next 30 days. Higher than 43.11% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- Fix
1.18.21- Upgrade github.com/hashicorp/consul to this version or later
Description
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/hashicorp/consul | < 1.18.21 |
1.18.21 |
| github.com/hashicorp/consul | >= 1.22.0-rc1, < 1.22.5 |
1.22.5 |
| github.com/hashicorp/consul | >= 1.19.0, < 1.21.11 |
1.21.11 |
| github.com/hashicorp/consul | < 1.22.5 |
1.22.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/hashicorp/consul Go → 1.18.21
- go
go get github.com/hashicorp/consul@v1.18.21 && go mod tidy
Severity breakdown
CVSS 3.1 6.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-59: Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qh7p-pfq3-677h Consul event endpoint is vulnerable to denial of service | Medium | Also affects github.com/hashicorp/consul |
| GHSA-7g3r-8c6v-hfmr Consul key/value endpoint is vulnerable to denial of service | Medium | Also affects github.com/hashicorp/consul |
| GHSA-99wr-c2px-grmh Hashicorp Consul Cross-site Scripting vulnerability | Medium | Also affects github.com/hashicorp/consul |
| GHSA-5c4w-8hhh-3c3h Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability | Medium | Also affects github.com/hashicorp/consul |
| GHSA-chgm-7r52-whjj Hashicorp Consul Path Traversal vulnerability | Medium | Also affects github.com/hashicorp/consul |
| GHSA-6m72-467w-94rh Privilege Escalation in HashiCorp Consul | Medium | Also affects github.com/hashicorp/consul |
| GHSA-496g-fr33-whrf Denial of service in HashiCorp Consul | High | Also affects github.com/hashicorp/consul |
| GHSA-9rhf-q362-77mx Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers | High | Also affects github.com/hashicorp/consul |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor