CVE-2026-19017 is a missing authorization vulnerability (CWE-862) in HashiCorp Consul Community Edition and Enterprise versions 1.18.21 through 2.0.2. When configured with the Vault Connect CA provider using JWT or AppRole authentication, a user with operator:write permissions can direct Consul to read and forward credential files outside the intended scope. This partial arbitrary file read may expose sensitive secrets stored on the Consul server host. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and a confidentiality impact rated as high. The flaw is fixed in Consul 2.0.3 and Enterprise versions 1.21.17, 1.22.11, and 2.0.3.

An attacker with operator:write permissions can exploit this vulnerability to read and exfiltrate sensitive credential files from the Consul server host, potentially compromising secrets used by the system. There is no impact on integrity or availability according to the CVSS vector. The confidentiality impact is high due to exposure of sensitive secrets.

Upgrade affected Consul versions to 2.0.3 or later for Community Edition, or to Enterprise versions 1.21.17, 1.22.11, or 2.0.3. This update fixes the missing authorization vulnerability. Until patched, restrict operator:write permissions to trusted users only. Patch status is confirmed fixed in these versions.