CVE-2026-2808
Fixed in a distro release EPSS <1%CVSS 6.8
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.
Products: HashiCorp Consul, HashiCorp Consul Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/consul | 1.18.21 |
| Go | github.com/hashicorp/consul | 1.22.5 |
| Go | github.com/hashicorp/consul | 1.21.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | consul-1.18 | no fix |
| Chainguard | consul-1.19 | no fix |
| Chainguard | consul-1.20 | no fix |
| Chainguard | consul-1.21 | no fix |
| Chainguard | consul-fips-1.19 | no fix |
| Chainguard | consul-fips-1.20 | no fix |
| Chainguard | consul-fips-1.21 | no fix |
| Debian:11 | consul | no fix |
| SUSE:Linux Enterprise Micro 5.3 | golang-github-docker-libnetwork | 0.7.0.1+gitr2908_55e924b8-150000.4.34.1 |
| SUSE:Linux Enterprise Micro 5.4 | golang-github-docker-libnetwork | 0.7.0.1+gitr2908_55e924b8-150000.4.34.1 |
| Ubuntu:18.04:LTS | consul | no fix |
| Ubuntu:20.04:LTS | consul | no fix |
| Ubuntu:22.04:LTS | consul | no fix |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0.0.20260317T205859-150000.1.152.1 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |