PT-2026-24892 · Hashicorp · Hashicorp Consul Enterprise+1

Defang Bo · Published 2026-03-11 · Updated 2026-03-25 · CVE-2026-2808

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul versions 1.18.20 through 1.21.10 HashiCorp Consul version 1.22.4 HashiCorp Consul Enterprise versions 1.18.20 through 1.21.10 HashiCorp Consul Enterprise version 1.22.4

Description HashiCorp Consul and Consul Enterprise are susceptible to an arbitrary file read issue when configured with Kubernetes authentication. The issue allows unauthorized access to files. The vulnerability is related to the vault kubernetes authentication provider.

Recommendations Versions 1.18.20 through 1.21.10: Upgrade to version 1.18.21 or 1.21.11. Version 1.22.4: Upgrade to version 1.22.5.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2026-06157

BIT-CONSUL-2026-2808

CVE-2026-2808

GHSA-CPFQ-66P2-336J

GO-2026-4690

SUSE-SU-2026:1042-1

Affected Products

Hashicorp Consul

Hashicorp Consul Enterprise

References · 145

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-2808 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cpfq-66p2-336j · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2808 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2808 · Security Note
• https://osv.dev/vulnerability/BIT-consul-2026-2808 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2808 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-2808 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06157 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2808 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4690 · Vendor Advisory
• https://github.com/hashicorp/consul · Note
• https://suse.com/security/cve/CVE-2026-31961 · Note
• https://suse.com/security/cve/CVE-2026-31817 · Note
• https://twitter.com/CVEnew/status/2031992358221607349 · Twitter Post