Security Bulletin: Consul vulnerable to partial arbitrary file read via Vault Connect CA provider

Summary Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and...

DEBIAN-CVE-2026-19017

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...

CVE-2026-19017 Consul vulnerable to partial arbitrary file read via Vault Connect CA provider

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...