CVE-2026-19017— Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
Quick assessment
Affected
HashiCorp Consul
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HashiCorp Consul是美国HashiCorp公司的一款服务发现与配置管理中间件。 HashiCorp Consul 1.18.21版本至2.0.2版本存在授权问题漏洞，该漏洞源于使用Vault Connect CA provider进行JWT或AppRole身份验证时未正确限制文件读取范围，具有operator:write权限的特权攻击者可读取并转发预期范围之外的凭据文件，可能导致敏感机密从Consul服务器主机泄露。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HashiCorp | Consul | 1.18.21< 2.0.3 |
affected |
| HashiCorp | Consul Enterprise | 1.18.21< 2.0.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19017
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
Source: CVE Program / CVE List V5
Vulnerability Description
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
HashiCorp Consul 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HashiCorp Consul是美国HashiCorp公司的一款服务发现与配置管理中间件。 HashiCorp Consul 1.18.21版本至2.0.2版本存在授权问题漏洞，该漏洞源于使用Vault Connect CA provider进行JWT或AppRole身份验证时未正确限制文件读取范围，具有operator:write权限的特权攻击者可读取并转发预期范围之外的凭据文件，可能导致敏感机密从Consul服务器主机泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Consul | 1.18.21 ~ 2.0.3 | - |
|
| HashiCorp | Consul Enterprise | 1.18.21 ~ 2.0.3 | - |
|
II. Public POCs for CVE-2026-19017
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19017
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-19017 (1)
Same Patch Batch · HashiCorp · 2026-08-07 · 8 CVEs total
| CVE-2026-15972 | 7.5 HIGH | Unauthenticated denial of service via unbounded external gRPC connection acceptance |
| CVE-2026-19113 | 5.3 MEDIUM | Unauthenticated denial of service via unbounded request body processing |
| CVE-2026-19012 | 5.3 MEDIUM | Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path |
| CVE-2026-19015 | 5.3 MEDIUM | Uncontrolled resource consumption in the Consul Connect CA roots endpoint |
| CVE-2026-19014 | 4.3 MEDIUM | Uncontrolled resource consumption in the Consul Connect authorization endpoint |
| CVE-2026-15970 | 4.2 MEDIUM | L7 intention authorization bypass via custom public listener |
| CVE-2026-19016 | 4.2 MEDIUM | Authorization bypass for session deletion in the transaction API |
IV. Related Vulnerabilities
Same product: Consul
-
CVE-2026-19113
Unauthenticated denial of service via unbounded request body -
CVE-2026-15972
Unauthenticated denial of service via unbounded external gRP -
CVE-2026-15970
L7 intention authorization bypass via custom public listener -
CVE-2026-19015
Uncontrolled resource consumption in the Consul Connect CA r -
CVE-2026-19014
Uncontrolled resource consumption in the Consul Connect auth
Same vendor: HashiCorp
-
CVE-2026-5006
Vault Vulnerable to Privilege Escalation via Slash Injection -
CVE-2026-14978
Unicode normalization mismatch in go-slug ignore pattern mat -
CVE-2026-19589
Packer vulnerable to arbitrary file write via crafted plugin -
CVE-2026-8715
Vault Secrets Operator vulnerable to arbitrary file read and -
CVE-2026-14886
Vault Enterprise vulnerable to cross-namespace entity deleti
Same weakness: CWE-862
-
CVE-2026-86091
ntopng before 6.7.260717 Missing Authorization on the Host P -
CVE-2026-86090
ntopng before 6.7.260717 Missing Authorization on the Notifi -
CVE-2026-82684
Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization -
CVE-2026-53769
Avo: Direct attachment upload endpoint lacks upload authoriz -
CVE-2026-63464
Nebula-mesh allows non-admin operators to disable webhook SS
V. Comments for CVE-2026-19017
No comments yet