Executive brief
Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication in github.com/hashicorp/consul
Affected products
- Go github.com/hashicorp/consul
Junglewise Threat Intelligence
CVE-2026-2808: GO-2026-4690 - Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication in github.com/hashicorp/consul
CVE-2026-2808 · Severity: low · CVSS 3.1 · Published 2026-03-16
Technologies: github.com/hashicorp/consul (Go). Vendors: Go.
Related threats
- GO-2025-4081 - Consul key/value endpoint is vulnerable to denial of service in github.com/hashicorp/consul
- GO-2025-4082 - Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul
- GO-2024-3242 - Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul
- GO-2024-3243 - Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul
- GO-2024-3241 - Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul