HashiCorp Consul Template 0.42.0 Path Redirection File Overwrite / Information Disclosure

This repository holds details relating to a HashiCorp Consul Template version 0.42.0 path redirection file overwrite vulnerability. HashiCorp Consul Template versions 0.42.0 and earlier contain a path resolution flaw in the writeToFile template helper where operator-supplied output paths are open...

CLEANSTART-2026-JS99622 Security fixes in consul-fips 1.22.2-r0

Package consul-fips version 1.22.2-r0 fixes 4 vulnerabilities: CVE-2025-61730, CVE-2026-27139, CVE-2026-24051, ghsa-9h8m-3fm2-qjrq...

CLEANSTART-2026-XX07268 Security fixes in consul-k8s-fips 1.8.1-r0

Package consul-k8s-fips version 1.8.1-r0 fixes 6 vulnerabilities: CVE-2025-22871, CVE-2025-4674, CVE-2025-47907, CVE-2025-47903, CVE-2025-47906...

CLEANSTART-2026-RT21199 Security fixes in consul 1.21.5-r3

Package consul version 1.21.5-r3 fixes 19 vulnerabilities: CVE-2026-39835, CVE-2026-46598, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502...

CLEANSTART-2026-BA45197 Security fixes in consul-k8s 1.7.13-r2

Package consul-k8s version 1.7.13-r2 fixes 5 vulnerabilities: CVE-2026-46680, CVE-2026-35469, CVE-2026-2303, CVE-2026-35206, CVE-2026-50151...

CLEANSTART-2026-WF12497 Security fixes in consul-k8s-fips 1.9.1-r2

Package consul-k8s-fips version 1.9.1-r2 fixes 4 vulnerabilities: CVE-2026-33186, CVE-2026-25679, CVE-2026-27142, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-FE95869 Security fixes in consul-k8s-fips 1.5.9-r0

Package consul-k8s-fips version 1.5.9-r0 fixes 4 vulnerabilities: CVE-2025-54410, CVE-2025-53547, CVE-2025-55198, CVE-2025-55199...

CLEANSTART-2026-WC52751 Security fixes in consul 1.22.5-r0

Package consul version 1.22.5-r0 fixes 2 vulnerabilities: ghsa-78h2-9frx-2jm8, CVE-2026-34986...

CLEANSTART-2026-IP63779 Security fixes in consul 1.22.7-r1

Package consul version 1.22.7-r1 fixes 24 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-RX52508 Security fixes in consul 2.0.0-r0

Package consul version 2.0.0-r0 fixes 21 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-EJ20938 Security fixes in consul 1.22.5-r1

Package consul version 1.22.5-r1 fixes 2 vulnerabilities: ghsa-p77j-4mvh-x3m3, CVE-2026-33186...

CLEANSTART-2026-FQ15535 Security fixes in consul-k8s 1.7.13-r1

Package consul-k8s version 1.7.13-r1 fixes 2 vulnerabilities: CVE-2026-42505, CVE-2026-39822...

CLEANSTART-2026-ZQ06753 Security fixes in consul-k8s 1.7.13-r0

Package consul-k8s version 1.7.13-r0 fixes 5 vulnerabilities: CVE-2026-42507, CVE-2026-39824, CVE-2026-25680, CVE-2026-39834, CVE-2026-34986...

CLEANSTART-2026-BJ58464 Security fixes in consul-k8s-fips 1.9.1-r0

Package consul-k8s-fips version 1.9.1-r0 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

CLEANSTART-2026-IR32723 Security fixes in consul-fips 1.22.2-r1

Package consul-fips version 1.22.2-r1 fixes 2 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-DK98219 Security fixes in consul 1.20.6-r0

Package consul version 1.20.6-r0 fixes 3 vulnerabilities: CVE-2025-65637, CVE-2026-34986, ghsa-4f99-4q7p-p3gh...

Security Bulletin: consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...

Security Bulletin: consul-mcp-server vulnerable to server side request forgery leading to token exposure

Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic...

CVE-2026-16328

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an...

CVE-2026-16326

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...