CVE-2026-2808: fallo de gravedad media en HashiCorp Consul
Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.8epss 0.5%
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVEs relacionadas — HashiCorp Consul
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-0845MEDIUMConsul Server Panic when Ingress and API Gateways Configured with PeeringEPSS 1.0%CVE-2024-10005HIGHConsul L7 Intentions Vulnerable To URL Path BypassEPSS 0.8%CVE-2023-1297MEDIUM Consul Cluster Peering can Result in Denial of ServiceEPSS 0.8%CVE-2022-3920MEDIUMConsul Peering Imported Nodes/Services LeakEPSS 0.7%CVE-2023-2816HIGHConsul Envoy Extension Downsteam Proxy Configuration By Upstream Service OwnerEPSS 0.6%CVE-2026-15972HIGHUnauthenticated denial of service via unbounded external gRPC connection acceptanceEPSS 0.5%