CVE-2026-19017: Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
consulto a version that resolves this vulnerability.Fixed in 2.0.3 - Upgrade
Upgrade
consul enterpriseto a version that resolves this vulnerability.Fixed in 1.21.17 - Upgrade
Upgrade
consul enterpriseto a version that resolves this vulnerability.Fixed in 1.22.11 - Upgrade
Upgrade
consul enterpriseto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19017?
The severity of CVE-2026-19017 is rated as medium with a score of 6.8.
How do I fix CVE-2026-19017?
To fix CVE-2026-19017, upgrade to Consul Community Edition or Consul Enterprise version 2.0.3 or later.
What systems are affected by CVE-2026-19017?
CVE-2026-19017 affects Consul Community Edition and Consul Enterprise versions 1.18.21 through 2.0.2.
What kind of attack does CVE-2026-19017 allow?
CVE-2026-19017 allows a privileged attacker to perform a partial arbitrary file read via the Vault Connect CA provider.
What permissions are required to exploit CVE-2026-19017?
To exploit CVE-2026-19017, an attacker needs to have 'operator:write' permission.