CVE-2026-2808: HashiCorp Consul File Read Vulnerability

CVE-2026-2808 Overview

CVE-2026-2808 affects HashiCorp Consul and Consul Enterprise when configured with Kubernetes authentication through the Vault Kubernetes authentication provider. The vulnerability allows an authenticated attacker with high privileges to read arbitrary files from the Consul server file system. The issue is classified under [CWE-59], improper link resolution before file access (link following). HashiCorp tracks this issue as HCSEC-2026-02 and has released fixed versions to address the flaw.

Critical Impact
Authenticated attackers can read arbitrary files from Consul servers configured with Kubernetes authentication, exposing sensitive configuration, secrets, and credentials.

Affected Products

HashiCorp Consul versions 1.18.20 through 1.21.10
HashiCorp Consul 1.22.4
HashiCorp Consul Enterprise across the same version ranges

Discovery Timeline

2026-03-12 - CVE-2026-2808 published to NVD
2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-2808

Vulnerability Analysis

The vulnerability resides in the Vault Kubernetes authentication provider integration within Consul. When Consul is configured to authenticate against Kubernetes, the auth flow processes file paths referenced during token validation. The path handling logic fails to properly resolve symbolic links before reading files. An attacker with sufficient privileges can manipulate this behavior to coerce the Consul process into reading files outside the intended scope.

The flaw maps to [CWE-59] (improper link resolution before file access). Because Consul typically runs with broad file system access on its host, the impact extends to any file readable by the Consul service account. This can include private keys, configuration files containing secrets, service tokens, and other Kubernetes-related credentials stored on the node.

Root Cause

The root cause is insufficient validation of file path inputs in the Vault Kubernetes authentication provider code path. The provider follows symbolic links during file reads instead of validating that the resolved path remains within an allowed directory. This permits link-following attacks against the Consul server file system.

Attack Vector

Exploitation requires network access to a Consul deployment with Kubernetes authentication enabled and high-privilege credentials. The attacker leverages the authentication provider to trigger file reads on attacker-influenced paths. Since the scope is changed (S:C in the CVSS vector), a successful read can expose data belonging to other services or tenants sharing the host. No user interaction is required.

No public proof-of-concept code has been published. Refer to the HashiCorp Security Discussion for the vendor's technical details.

Detection Methods for CVE-2026-2808

Indicators of Compromise

Unexpected file read operations performed by the Consul process targeting paths outside its configuration and data directories.
Anomalous access patterns against sensitive files such as /etc/shadow, /root/.kube/, or service account token mounts.
Authentication requests against the Vault Kubernetes auth provider that reference unusual file paths or symbolic links.

Detection Strategies

Audit Consul server logs for Kubernetes authentication events and correlate them with file system access on the host.
Enable Linux audit rules (auditd) to record open() and readlink() syscalls by the Consul service account.
Review Vault audit logs for token validation requests originating from unexpected Consul instances or service accounts.

Monitoring Recommendations

Monitor Consul host file system telemetry for reads of credential files by the Consul binary.
Alert on creation of symbolic links inside directories used by Consul or Vault Kubernetes auth.
Track changes to Consul versions and Kubernetes auth method configurations across the fleet.

How to Mitigate CVE-2026-2808

Immediate Actions Required

Upgrade Consul to 1.18.21, 1.21.11, or 1.22.5 depending on the deployed release branch.
Inventory all Consul clusters that use Vault Kubernetes authentication and prioritize them for patching.
Rotate any secrets, tokens, or keys readable by the Consul service account if compromise is suspected.

Patch Information

HashiCorp fixed CVE-2026-2808 in Consul 1.18.21, 1.21.11, and 1.22.5. The patches are described in the HashiCorp Security Discussion. Enterprise customers should apply the equivalent Enterprise release for their branch.

Workarounds

Restrict Kubernetes authentication privileges so that only trusted operators can issue auth requests against Consul.
Run the Consul process under a dedicated low-privilege user with file system access limited to its required directories.
Disable the Vault Kubernetes auth method on affected Consul deployments until patching is complete if operationally feasible.

bash

# Verify the installed Consul version after upgrade
consul version

# Example expected output on a patched 1.21.x deployment
# Consul v1.21.11