StackRadar

CVE-2026-2808

Medium

Advisory

Published 12 Mar 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.8
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
21
of 17,781 indexed, latest versions
Container images
18
deployed by those charts
Fix available
3 of 3
affected packages

Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider

Carried by container images the latest versions of 21 of 17,781 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
github.com/hashicorp/consulgolangv0.0.0-20171026175957-610f3c86a089, v0.0.0-20221130195431-0ba7a4018304, v1.4.4, v1.4.5+4 more1.18.21, 1.21.1112
consulgolang1.14.2, 1.15.3, 1.15.4, 1.17.0+2 more1.18.21, 1.21.117
consulbitnami1.21.4-11.22.51
OSV records
BIT-consul-2026-2808GHSA-cpfq-66p2-336j
Also known as
GO-2026-4690

Charts affected

21 by stars
ChartLatestAffected imagesRadar Score
coreneuvectorchartsVerified publisher2.11.12 of 5See more

core neuvectorcharts 2.11.1

2 of the 5 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
neuvector/controller:5.6.1ae45c394f1ac
consul@1.18.0
1.18.21
neuvector/enforcer:5.6.1aa2137cc90ec
consul@1.18.0
1.18.21

Open the chart page →

884
codefreshcodefresh-onpremOfficialVerified publisher2.12.131 of 42See more

codefresh codefresh-onprem 2.12.13

1 of the 42 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
bitnamilegacy/consul:1.21.4-debian-12-r133ae872fc99d
consul@1.21.4-1
github.com/hashicorp/consul@v1.21.4
1.22.5
1.21.11

Open the chart page →

14,956
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
library/traefik:2.5.47d0228d19042
github.com/hashicorp/consul@v1.10.3
1.18.21

Open the chart page →

52,919
pubsubplus-hasolaceVerified publisher3.10.01 of 1See more

pubsubplus-ha solace 3.10.0

1 of the 1 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
solace/solace-pubsub-standard:latest8e8ad105595e
consul@1.19.0
1.21.11

Open the chart page →

236
traefik-meshtraefikOfficialVerified publisher4.1.11 of 7See more

traefik-mesh traefik 4.1.1

1 of the 7 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
library/traefik:v2.57d5a6ae66572
github.com/hashicorp/consul@v1.10.3
1.18.21

Open the chart page →

9,257
alertmanager-botgeek-cookbookVerified publisher6.4.21 of 1See more

alertmanager-bot geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
metalmatze/alertmanager-bot:0.4.3426bc2ca7586
github.com/hashicorp/consul@v1.4.5
1.18.21

Open the chart page →

3,586
voice-biometricslumenvox2.0.11 of 26See more

voice-biometrics lumenvox 2.0.1

1 of the 26 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
library/traefik:v2.57d5a6ae66572
github.com/hashicorp/consul@v1.10.3
1.18.21

Open the chart page →

70,741
pubsubplussolaceVerified publisher3.10.01 of 1See more

pubsubplus solace 3.10.0

1 of the 1 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
solace/solace-pubsub-standard:latest8e8ad105595e
consul@1.19.0
1.21.11

Open the chart page →

236
pubsubplus-devsolaceVerified publisher3.10.01 of 1See more

pubsubplus-dev solace 3.10.0

1 of the 1 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
solace/solace-pubsub-standard:latest8e8ad105595e
consul@1.19.0
1.21.11

Open the chart page →

236
traefik-hubtraefikOfficialVerified publisher4.2.01 of 1See more

traefik-hub traefik 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
ghcr.io/traefik/traefik-hub:v2.11.0322f5f8cc105
github.com/hashicorp/consul@v1.10.12
1.18.21

Open the chart page →

3,165
atlantistrozz3.12.111 of 1See more

atlantis trozz 3.12.11

1 of the 1 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
runatlantis/atlantis:v0.16.145fbaf7e207c
github.com/hashicorp/consul@v0.0.0-20171026175957-610f3c86a089
1.18.21

Open the chart page →

5,280
ibm-toolkit-installcloud-native-toolkit0.3.01 of 1See more

ibm-toolkit-install cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
github.com/hashicorp/consul@v0.0.0-20171026175957-610f3c86a089
1.18.21

Open the chart page →

6,695
cosmo-traefikcosmoVerified publisher0.9.11 of 2See more

cosmo-traefik cosmo 0.9.1

1 of the 2 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
library/traefik:v2.10.11489caffaedb
github.com/hashicorp/consul@v1.10.12
1.18.21

Open the chart page →

3,672
cac-systemhuangchengwu-helm-chart0.1.01 of 9See more

cac-system huangchengwu-helm-chart 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
huangchengwu6904/hi-app:cac-16910478061b932f8221a9
consul@1.15.4
1.18.21

Open the chart page →

11,186
consulintelVerified publisher0.8.11 of 2See more

consul intel 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
hashicorp/consul:1.14.2e38576edcdfd
consul@1.14.2
github.com/hashicorp/consul@v0.0.0-20221130195431-0ba7a4018304
1.18.21
1.18.21

Open the chart page →

5,389
evi-consulintelVerified publisher3.0.31 of 2See more

evi-consul intel 3.0.3

1 of the 2 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
hashicorp/consul:1.14.2e38576edcdfd
consul@1.14.2
github.com/hashicorp/consul@v0.0.0-20221130195431-0ba7a4018304
1.18.21
1.18.21

Open the chart page →

5,389
flaggermesosphere0.21.01 of 2See more

flagger mesosphere 0.21.0

1 of the 2 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
weaveworks/flagger:0.19.0a9c2e9df4227
github.com/hashicorp/consul@v1.4.4
1.18.21

Open the chart page →

6,048
ed-traefik2scaleway-charts0.2.01 of 1See more

ed-traefik2 scaleway-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
library/traefik:2.5.62f603f8d3abe
github.com/hashicorp/consul@v1.10.3
1.18.21

Open the chart page →

3,160
vaultstatcan0.1.81 of 2See more

vault statcan 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
hashicorp/vault-k8s:0.6.05697b85bc69a
github.com/hashicorp/consul@v1.5.0
1.18.21

Open the chart page →

4,222
consulwarjiang1.3.01 of 2See more

consul warjiang 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
hashicorp/consul:1.17.0712fe02d2f84
consul@1.17.0
1.18.21

Open the chart page →

4,060
zahori-consulzahoriVerified publisher1.0.11 of 2See more

zahori-consul zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-2808.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
consul@1.15.3
1.18.21

Open the chart page →

5,033

Container images carrying it

18 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
solace/solace-pubsub-standard:latest8e8ad105595e
consul@1.19.0
1.21.11
3
hashicorp/consul:1.14.2e38576edcdfd
consul@1.14.2
github.com/hashicorp/consul@v0.0.0-20221130195431-0ba7a4018304
1.18.21
1.18.21
2
library/traefik:v2.57d5a6ae66572
github.com/hashicorp/consul@v1.10.3
1.18.21
2
bitnamilegacy/consul:1.21.4-debian-12-r133ae872fc99d
consul@1.21.4-1
github.com/hashicorp/consul@v1.21.4
1.22.5
1.21.11
1
hashicorp/consul:1.17.0712fe02d2f84
consul@1.17.0
1.18.21
1
hashicorp/consul:1.15.3ddff34041c5c
consul@1.15.3
1.18.21
1
hashicorp/vault-k8s:0.6.05697b85bc69a
github.com/hashicorp/consul@v1.5.0
1.18.21
1
huangchengwu6904/hi-app:cac-16910478061b932f8221a9
consul@1.15.4
1.18.21
1
library/traefik:v2.10.11489caffaedb
github.com/hashicorp/consul@v1.10.12
1.18.21
1
library/traefik:2.5.62f603f8d3abe
github.com/hashicorp/consul@v1.10.3
1.18.21
1
library/traefik:2.5.47d0228d19042
github.com/hashicorp/consul@v1.10.3
1.18.21
1
metalmatze/alertmanager-bot:0.4.3426bc2ca7586
github.com/hashicorp/consul@v1.4.5
1.18.21
1
neuvector/controller:5.6.1ae45c394f1ac
consul@1.18.0
1.18.21
1
neuvector/enforcer:5.6.1aa2137cc90ec
consul@1.18.0
1.18.21
1
runatlantis/atlantis:v0.16.145fbaf7e207c
github.com/hashicorp/consul@v0.0.0-20171026175957-610f3c86a089
1.18.21
1
weaveworks/flagger:0.19.0a9c2e9df4227
github.com/hashicorp/consul@v1.4.4
1.18.21
1
ghcr.io/traefik/traefik-hub:v2.11.0322f5f8cc105
github.com/hashicorp/consul@v1.10.12
1.18.21
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
github.com/hashicorp/consul@v0.0.0-20171026175957-610f3c86a089
1.18.21
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.