GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, authservice, slsa-verifier, helm-mapkubeapis, otel-cli, newrelic-fluent-bit-output, kyverno, caddy, osv-scanner, golangci-lint, falcoctl, argo-workflows, envconsul, dask-gateway, sftpgo-plugin-eventsearch, cadvisor,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: cloud-provider-azure-fips, step-ca, cloud-provider-aws-fips, keda-fips, kubernetes-csi-node-driver-registrar-fips, eksctl, trivy-operator-fips, fuse-overlayfs-snapshotter, gitea-fips, aws-flb-kinesis-fips, cerbos, opentofu, knative-eventing-fips, ko-fips, rancher-hel...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: cloud-provider-azure-fips, step-ca, cloud-provider-aws-fips, keda-fips, kubernetes-csi-node-driver-registrar-fips, eksctl, trivy-operator-fips, fuse-overlayfs-snapshotter, gitea-fips, aws-flb-kinesis-fips, cerbos, opentofu, knative-eventing-fips, ko-fips, rancher-hel...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: cloud-provider-azure-fips, step-ca, cloud-provider-aws-fips, keda-fips, kubernetes-csi-node-driver-registrar-fips, kubernetes-dashboard-fips, eksctl, trivy-operator-fips, google-guest-agent-manager, dapr-fips, fuse-overlayfs-snapshotter, gitea-fips,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: cloud-provider-azure-fips, opentelemetry-collector, step-ca, cloud-provider-aws-fips, keda-fips, kubernetes-csi-node-driver-registrar-fips, kubernetes-dashboard-fips, rancher-pushprox-fips, eksctl, mods, trivy-operator-fips, scuttle, actions-runner-controller,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: cloud-provider-azure-fips, step-ca, cloud-provider-aws-fips, keda-fips, kubernetes-csi-node-driver-registrar-fips, kubernetes-dashboard-fips, rancher-pushprox-fips, eksctl, mods, trivy-operator-fips, scuttle, actions-runner-controller, google-guest-agent-manager,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, age-fips, prometheus-redis-exporter, container-object-storage-interface-fips, cerbos, kubernetes-dashboard-metrics-scraper-fips, knative-eventing-fips, mig-parted, cadvisor-fips, kubernetes, gitleaks, terraform-provider-azapi-fips,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: cloud-provider-azure-fips, opentelemetry-collector, step-ca, cloud-provider-aws-fips, keda-fips, kubernetes-csi-node-driver-registrar-fips, kubernetes-dashboard-fips, rancher-pushprox-fips, eksctl, mods, trivy-operator-fips, scuttle, actions-runner-controller,...

CLEANSTART-2026-SF31652 Security fixes for CVE-2025-61730, CVE-2026-24051, CVE-2026-27139, CVE-2026-33186, ghsa-9h8m-3fm2-qjrq, ghsa-p77j-4mvh-x3m3 applied in versions: 1.22.2-r0, 1.22.2-r1

Multiple security vulnerabilities affect the consul-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XO65991 Security fixes for CVE-2025-61730, CVE-2026-24051, CVE-2026-27139, ghsa-9h8m-3fm2-qjrq applied in versions: 1.22.2-r0

Multiple security vulnerabilities affect the consul-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

GO-2026-4690 Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication in github.com/hashicorp/consul

Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication in github.com/hashicorp/consul...

BIT-CONSUL-2026-2808 Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5...

SUSE CVE-2026-2808

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5...

CVE-2026-2808

A flaw was found in HashiCorp Consul. When configured with Kubernetes authentication, a highly privileged attacker can exploit this vulnerability to perform arbitrary file reads. This could lead to the disclosure of sensitive information from the system...

EUVD-2026-11487

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the the Vault Kubernetes Authentication Provider. An attacker can access sensitive files by specifying tokenpath configuration parameter to any file on the Consul server node that later returned as jwt data and sent t...

GHSA-CPFQ-66P2-336J Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5...

Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5...

Security Bulletin: Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider

Summary HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5. Vulnerability Details CVEID:CVE-2026-2808...

CVE-2026-2808

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5...