cve.bz

CVE-2026-2808

6.8 mediumEPSS 0.5%

Medium (6.8). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/consul 1.18.21, 1.21.11, 1.22.5.

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.

Severity

CVSS 3.1

6.8 medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE
CWE-59
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-cpfq-66p2-336jGogithub.com/hashicorp/consul<1.18.211.18.21
GHSA-cpfq-66p2-336jGogithub.com/hashicorp/consul>=1.22.0-rc1 <1.22.51.22.5
GHSA-cpfq-66p2-336jGogithub.com/hashicorp/consul>=1.19.0 <1.21.111.21.11
GO-2026-4690Gogithub.com/hashicorp/consul<1.22.51.22.5

References

Check your stackJSON