CVE-2026-19017: Consul Information Disclosure Vulnerability

CVE-2026-19017 Overview

CVE-2026-19017 is a partial arbitrary file read vulnerability affecting HashiCorp Consul Community Edition and Consul Enterprise versions 1.18.21 through 2.0.2. The flaw exists in the Vault Connect Certificate Authority (CA) provider when configured with JSON Web Token (JWT) or AppRole authentication. A privileged attacker with operator:write permission can direct Consul to read and forward credential files outside the intended scope. Successful exploitation can lead to exfiltration of sensitive secrets from the Consul server host. The issue is tracked under CWE-862: Missing Authorization and is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Critical Impact
A privileged operator can coerce the Consul server to read arbitrary credential files, exposing secrets stored on the Consul server host.

Affected Products

HashiCorp Consul Community Edition 1.18.21 through 2.0.2
HashiCorp Consul Enterprise 1.18.21 through 2.0.2
Deployments using the Vault Connect CA provider with JWT or AppRole authentication

Discovery Timeline

2026-08-07 - CVE-2026-19017 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-19017

Vulnerability Analysis

Consul integrates with HashiCorp Vault as a Connect CA provider to issue and manage service mesh certificates. When configured with JWT or AppRole authentication methods, Consul reads credential material from files on the server host to authenticate to Vault. The vulnerability arises because Consul does not sufficiently restrict which file paths an operator can specify when configuring these credential inputs.

An attacker with the operator:write Access Control List (ACL) permission can modify the Connect CA configuration to point Consul at arbitrary files on the server host. Consul then reads those files as part of the authentication flow and can forward their contents outside the intended trust boundary. The scope is limited to a partial read because Consul only exposes portions of the file that fit the credential parsing logic.

Root Cause

The root cause is missing authorization and inadequate path validation on file references supplied through the Vault Connect CA provider configuration. The operator:write capability was not designed to grant filesystem read access, so the provider effectively broadens the privilege granted by that ACL beyond its intended scope.

Attack Vector

Exploitation requires an authenticated Consul client token with operator:write privileges and network reachability to the Consul HTTP API. The attacker updates the Connect CA provider configuration to reference target credential files such as tokens, keys, or service account secrets stored on the Consul server host. Consul reads the referenced files during the next Vault authentication attempt, and content is disclosed through configuration echoes, error output, or forwarded credential material.

Refer to the HashiCorp Security Advisory HCSEC-2026-25 for the vendor's technical description.

Detection Methods for CVE-2026-19017

Indicators of Compromise

Unexpected changes to the Connect CA provider configuration via PUT /v1/connect/ca/configuration or the consul connect ca set-config command.
Connect CA configurations referencing file paths outside the standard Vault credential directory, such as /etc/, /root/, or application secret locations.
Consul server logs showing Vault authentication attempts with unusual token_file or secret_id_file parameters.

Detection Strategies

Audit historical Consul API access logs for operator:write calls that modified the Connect CA configuration.
Compare current Connect CA configuration against a known-good baseline for JWT and AppRole authentication paths.
Correlate ACL token issuance events with subsequent Connect CA configuration changes to identify unauthorized privilege use.

Monitoring Recommendations

Enable Consul audit logging and forward events to a centralized Security Information and Event Management (SIEM) platform for retention and analysis.
Monitor file access on Consul server hosts for reads of credential files by the Consul process outside expected paths.
Alert on any modification to connect.ca_config fields, particularly token_file, secret_id_file, and role_id_file.

How to Mitigate CVE-2026-19017

Immediate Actions Required

Upgrade Consul Community Edition to version 2.0.3 or later.
Upgrade Consul Enterprise to 1.21.17, 1.22.11, or 2.0.3 depending on your release track.
Rotate any credentials, tokens, or keys that may have been readable by the Consul process on affected servers.
Review and revoke operator:write ACL tokens that are not strictly required for administrative workflows.

Patch Information

HashiCorp addressed CVE-2026-19017 in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. See the HashiCorp Security Advisory HCSEC-2026-25 for release notes and download links.

Workarounds

Restrict operator:write ACL permissions to a minimal set of trusted administrators until patching is complete.
Avoid using the Vault Connect CA provider with JWT or AppRole authentication on unpatched clusters, or switch to token-based Vault authentication temporarily.
Enforce filesystem permissions on the Consul server host so that sensitive credential files are not readable by the Consul process user.

bash

# Verify installed Consul version
consul version

# Inspect the current Connect CA configuration for unexpected file references
consul connect ca get-config

# List ACL tokens with operator:write and review necessity
consul acl token list