CVE-2026-2808: HashiCorp Consul File Read Vulnerability

CVE-2026-2808 Overview

CVE-2026-2808 is an arbitrary file read vulnerability affecting HashiCorp Consul and Consul Enterprise versions 1.18.20 up to 1.21.10 and 1.22.4. The vulnerability is exploitable when Consul is configured with Kubernetes authentication, allowing attackers to read arbitrary files from the system. This vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access), commonly known as a symlink attack.

Critical Impact

Authenticated attackers with high privileges can exploit this vulnerability to read sensitive files from the Consul server filesystem, potentially exposing secrets, configuration data, and other confidential information in Kubernetes environments.

Affected Products

• HashiCorp Consul versions 1.18.20 through 1.18.20
• HashiCorp Consul versions 1.21.10 and earlier in the 1.21.x branch
• HashiCorp Consul Enterprise versions 1.22.4 and earlier in the 1.22.x branch

Discovery Timeline

• 2026-03-12 - CVE-2026-2808 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-2808

Vulnerability Analysis

This vulnerability stems from improper link resolution before file access (CWE-59) within the Vault Kubernetes authentication provider component of HashiCorp Consul. When Consul is configured to use Kubernetes authentication, the system fails to properly validate file paths, enabling attackers to leverage symlink attacks to read arbitrary files from the underlying filesystem.

The attack requires network access and high privileges, but once exploited, it can affect resources beyond the vulnerable component's security scope. The primary impact is on confidentiality, as attackers can access sensitive data stored on the Consul server without affecting system integrity or availability.

Root Cause

The root cause of CVE-2026-2808 is improper link resolution before file access in the Vault Kubernetes authentication provider. The vulnerable code path does not adequately verify that file paths resolve to intended locations, allowing symbolic links to be followed to arbitrary filesystem locations. This type of symlink following vulnerability occurs when the application trusts user-controlled paths without canonicalizing them or checking their final destinations.

Attack Vector

The attack is network-based and requires the attacker to have high privileges within the target Consul environment. The exploitation flow involves:

1. The attacker must have authenticated access to a Consul instance configured with Kubernetes authentication
2. By crafting malicious requests through the Vault Kubernetes authentication provider, the attacker can manipulate file path resolution
3. The vulnerable component follows symbolic links without proper validation, allowing access to files outside the intended directory
4. Sensitive files such as service tokens, configuration files, or secrets stored on the Consul server can be exfiltrated

The vulnerability can be exploited through the Vault Kubernetes authentication mechanism. For detailed technical information about the exploitation technique, refer to the HashiCorp Security Discussion advisory.

Detection Methods for CVE-2026-2808

Indicators of Compromise

• Unusual file access patterns in Consul server logs, particularly requests targeting sensitive system paths
• Authentication requests through the Kubernetes auth provider that reference unexpected file paths or contain path traversal sequences
• Audit log entries showing access to files outside normal Consul data directories
• Unexpected read operations on sensitive files like /etc/passwd, service account tokens, or Consul configuration files

Detection Strategies

• Monitor Consul audit logs for authentication requests containing path manipulation characters or symlink references
• Implement file integrity monitoring on the Consul server to detect unauthorized file access attempts
• Deploy SentinelOne Singularity to detect and alert on anomalous file read patterns associated with symlink exploitation
• Review Kubernetes authentication provider configurations and audit authentication flows for suspicious activity

Monitoring Recommendations

• Enable verbose logging for the Vault Kubernetes authentication provider to capture detailed request information
• Configure alerts for file access attempts outside the expected Consul data directories
• Implement runtime application self-protection (RASP) to monitor and block symlink attack patterns
• Use SentinelOne's Kubernetes Sentinel to monitor container and pod behavior for exploitation attempts

How to Mitigate CVE-2026-2808

Immediate Actions Required

• Upgrade HashiCorp Consul to patched versions: 1.18.21, 1.21.11, or 1.22.5 immediately
• Review Kubernetes authentication configurations and restrict access to only necessary service accounts
• Audit file permissions on Consul servers to minimize the impact of potential file read exploits
• Implement network segmentation to limit exposure of Consul servers to trusted networks only

Patch Information

HashiCorp has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• Consul 1.18.21 for the 1.18.x branch
• Consul 1.21.11 for the 1.21.x branch
• Consul 1.22.5 for the 1.22.x branch

The security advisory is available at the HashiCorp Security Discussion page with detailed upgrade instructions.

Workarounds

• If immediate patching is not possible, consider temporarily disabling Kubernetes authentication until upgrades can be applied
• Implement strict file system permissions to limit readable files on Consul servers
• Deploy additional access controls and network policies to restrict who can authenticate through the Kubernetes provider
• Use read-only root filesystems for Consul containers where possible to limit the attack surface

# Verify current Consul version and plan upgrade
consul version

# Example: Upgrading Consul on Kubernetes via Helm
helm repo update hashicorp
helm upgrade consul hashicorp/consul --version <fixed-version> --namespace consul