HashiCorp Consul and Consul Enterprise are affected by a Path Traversal vulnerability (CWE‑59) in the Vault Kubernetes authentication provider. The flaw allows an authenticated attacker to craft requests that result in reading arbitrary files from the host filesystem, potentially exposing sensitive configuration data, credentials, or other confidential information. This vulnerability directly compromises confidentiality and could be leveraged as a foothold for further exploitation.

Affected are HashiCorp Consul and Consul Enterprise versions 1.18.20 through 1.21.10 and 1.22.4. Any deployment using these versions with Kubernetes authentication enabled is vulnerable. The issue has been fixed in Consul releases 1.18.21, 1.21.11, and 1.22.5 and later.

The vulnerability has a CVSS v3.1 score of 6.8 (Medium) and an EPSS score below 1 %, indicating a low probability of widespread exploitation. It does not appear in the CISA KEV catalog. Based on the description, the likely attack vector requires access to the Vault Kubernetes authentication interface; an attacker must be able to send specially crafted requests that bypass proper path validation to read unintended files.