CVE-2026-19017
published 2026-08-07CVE-2026-19017: Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect…
PriorityP340medium6.8CVSS 3.1
AVNACLPRHUINSCCHINAN
EPSS
0.46%
39.2th percentile
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hashicorp | consul | >= 1.18.21 < 2.0.3 | 2.0.3 |
| hashicorp | consul_enterprise | >= 1.18.21 < 2.0.3 | 2.0.3 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
consul: Consul: Sensitive secret exfiltration via partial arbitrary file read
vendor_redhat·2026-08-07·CVSS 6.8
CVE-2026-19017 [MEDIUM] CWE-125 consul: Consul: Sensitive secret exfiltration via partial arbitrary file read
consul: Consul: Sensitive secret exfiltration via partial arbitrary file read
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
A flaw was found in Consul. A privileged attacker with `operator:write` permission can exploit a partial arbitrary file read vulnerability when Consul is configured to use th
GHSA
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentica
ghsa_unreviewed·2026-08-07·CVSS 6.8
CVE-2026-19017 [MEDIUM] CWE-862 Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentica
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
VulDB
HashiCorp Consul/Consul Enterprise path traversal
vuldb·2026-08-07·CVSS 6.8
CVE-2026-19017 [MEDIUM] HashiCorp Consul/Consul Enterprise path traversal
A vulnerability was found in HashiCorp Consul and Consul Enterprise and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation results in path traversal.
This vulnerability is known as CVE-2026-19017. It is possible to launch the attack remotely. No exploit is available.
No detection rules found.
No public exploits indexed.
2026-08-07
Published