Description

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-07T20:16:50.660Z",
  "pubdate": "2026-08-07T20:16:50.660Z",
  "executiveSummary": "A partial arbitrary file read vulnerability, designated as CVE-2026-19017, exists in Consul Community Edition and Consul Enterprise versions 1.18.21 through 2.0.2.\nThe vulnerability occurs when Consul is configured to utilize the Vault Connect CA provider configured with either JSON Web Token (JWT) or AppRole authentication mechanisms.\nAn authenticated attacker possessing operator:write permissions can exploit this flaw by directing Consul to read and forward credential files located outside the intended operational scope.\nSuccessful exploitation leads to the potential exfiltration of sensitive secrets and confidential material directly from the underlying Consul server host.\nThis vulnerability represents a significant risk to server confidentiality and host integrity, requiring administrative privileges and specific Vault Connect CA provider configurations to execute.",
  "technicalDetails": "The vulnerability stems from improper handling of file path references when Consul communicates with the Vault Connect CA provider using JWT or AppRole authentication schemes.\nThe affected components comprise the Vault Connect CA integration module within Consul Community Edition and Consul Enterprise versions 1.18.21 through 2.0.2.\nExploitation requires the attacker to hold the operator:write permission level, indicating that an initial authentication and high-privilege access tier are prerequisites for attack execution.\nThe attack flow initiates when the privileged malicious actor crafts specific operational commands or configuration directives instructing the Consul server to ingest credential files.\nDue to insufficient input validation and path restriction enforcement within the affected versions, the application processes references to file paths outside of the designated secure scope.\nConsul subsequently reads the targeted files from the host filesystem and forwards the data through the authentication handling workflow established for the Vault Connect CA provider.\nThe post-exploitation impact includes the exposure of sensitive secrets, private credentials, or configuration files residing on the Consul server host, facilitating further lateral movement or privilege escalation across connected infrastructure environments."
}