Fluid Attacks Database

Description

Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	consul	=1.10.12+dfsg1-1 \|\| =1.8.7+dfsg1-2 \|\| =1.8.7+dfsg1-3 \|\| =1.8.7+dfsg1-4 \|\| =1.8.7+dfsg1-5 \|\| =1.8.7+dfsg1-6 \|\| =1.9.17+dfsg2-1	-
go	github.com/hashicorp/consul	>=0 <1.18.21 \|\| >=1.22.0-rc1 <1.22.5 \|\| >=1.19.0 <1.21.11	1.18.21, 1.22.5, 1.21.11

Aliases

1. CVE-2026-28082. NVD-2026-28083. OSV-DEBIAN-2026-28084. OSV-2026-28085. GCVE-2026-28086. SECURITY-TRACKER-CVE-2026-2808

References

1. https://discuss.hashicorp.com/t/hcsec-2026-02-consul-vulnerable-to-arbitrary-file-reads-through-the-vault-kubernetes-authentication-provider/772322. https://pkg.go.dev/vuln/GO-2026-4690