What is GHSA-cpfq-66p2-336j?

GHSA-cpfq-66p2-336j is a security advisory published by GitHub Security Advisories with Medium severity. Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication

Which CVE IDs does GHSA-cpfq-66p2-336j cover?

GHSA-cpfq-66p2-336j covers the following CVE IDs: CVE-2026-2808. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cpfq-66p2-336j?

GHSA-cpfq-66p2-336j has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

Which products are affected by GHSA-cpfq-66p2-336j?

GHSA-cpfq-66p2-336j affects 3 products, including: go/github.com/hashicorp/consul:\u003c 1.18.21; go/github.com/hashicorp/consul:\u003e= 1.22.0-rc1, \u003c 1.22.5; go/github.com/hashicorp/consul:\u003e= 1.19.0, \u003c 1.21.11.

GHSA-cpfq-66p2-336jMediumCVSS 6.8

Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication

Vendor

GitHub Security Advisories

Published

March 12, 2026

Last Modified

March 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-2808 →

📋 Description

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.

🎯 Affected products3

go/github.com/hashicorp/consul:< 1.18.21
go/github.com/hashicorp/consul:>= 1.22.0-rc1, < 1.22.5
go/github.com/hashicorp/consul:>= 1.19.0, < 1.21.11

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-2808
https://discuss.hashicorp.com/t/hcsec-2026-02-consul-vulnerable-to-arbitrary-file-reads-through-the-vault-kubernetes-authentication-provider/77232
https://pkg.go.dev/vuln/GO-2026-4690
https://github.com/advisories/GHSA-cpfq-66p2-336j