PT-2026-24892 · Hashicorp · Hashicorp Consul Enterprise+1

Defang Bo · Publicado 2026-03-11 · Atualizado 2026-03-25 · CVE-2026-2808

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul versions 1.18.20 through 1.21.10 HashiCorp Consul version 1.22.4 HashiCorp Consul Enterprise versions 1.18.20 through 1.21.10 HashiCorp Consul Enterprise version 1.22.4

Description HashiCorp Consul and Consul Enterprise are susceptible to an arbitrary file read issue when configured with Kubernetes authentication. The issue allows unauthorized access to files. The vulnerability is related to the vault kubernetes authentication provider.

Recommendations Versions 1.18.20 through 1.21.10: Upgrade to version 1.18.21 or 1.21.11. Version 1.22.4: Upgrade to version 1.22.5.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

BDU:2026-06157

BIT-CONSUL-2026-2808

CVE-2026-2808

GHSA-CPFQ-66P2-336J

GO-2026-4690

SUSE-SU-2026:1042-1

Produtos afetados

Hashicorp Consul

Hashicorp Consul Enterprise

Referências · 145

• https://github.com/hashicorp/consul · Nota
• https://suse.com/security/cve/CVE-2026-31961 · Nota
• https://suse.com/security/cve/CVE-2026-31817 · Nota
• https://twitter.com/CVEnew/status/2031992358221607349 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-26276 · Nota
• https://suse.com/security/cve/CVE-2026-22728 · Nota
• https://suse.com/security/cve/CVE-2026-30926 · Nota
• https://suse.com/security/cve/CVE-2026-30869 · Nota
• https://suse.com/security/cve/CVE-2026-25963 · Nota
• https://suse.com/security/cve/CVE-2026-27616 · Nota
• https://suse.com/security/cve/CVE-2026-32246 · Nota
• https://suse.com/security/cve/CVE-2026-30247 · Nota
• https://suse.com/security/cve/CVE-2026-24004 · Nota
• https://suse.com/security/cve/CVE-2026-29042 · Nota
• https://suse.com/security/cve/CVE-2026-30933 · Nota