CVE-2026-19017

Name of the Vulnerable Software and Affected Versions Consul Community Edition versions 1.18.21 through 2.0.2 Consul Enterprise versions 1.18.21 through 2.0.2

Description An issue exists when the software is configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission can direct the system to read and forward credential files outside the intended scope, which may lead to the exfiltration of sensitive secrets from the server host.

Recommendations Update Consul Community Edition to version 2.0.3. Update Consul Enterprise to versions 1.21.17, 1.22.11, or 2.0.3.