CVE-2026-8715: Consul Vulnerable to Arbitrary File Read and Credential Exfiltration
Summary
CVE-2026-8715: Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissi... Affects consul versions >= 1.3.0, < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Consul is a distributed service mesh solution designed for connecting and securing services across dynamic infrastructures. It provides features such as service discovery, configuration, and orchestration. The Vault Secrets Operator integrates with Consul to manage secrets and sensitive data. However, versions 1.3.0 to 1.4.1 of the Vault Secrets Operator are susceptible to a vulnerability that allows unauthorized access to the operator pod's filesystem.
Vulnerability Detail
The vulnerability identified as CVE-2026-8715 arises from a flaw in the AppRole authentication configuration within the Vault Secrets Operator. This issue permits a tenant with limited Kubernetes RBAC permissions to read arbitrary files from the operator pod's filesystem. The contents of these files can then be transmitted to an endpoint controlled by the tenant, potentially leading to privilege escalation within the Kubernetes cluster. This poses a significant security risk as it may allow unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the AppRole secretIDPath by modifying the Kubernetes RBAC permissions to limit which tenants can access the Vault Secrets Operator. This can be done by adjusting the Role or ClusterRole bindings associated with the operator.
Conclusion
CVE-2026-8715 is a critical vulnerability in the Vault Secrets Operator that poses significant security risks. It is crucial for users to update to version 1.5.0 or later to protect against potential exploitation. Additionally, implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for consul →
FAQ
CVE-2026-8715 is a vulnerability in the Vault Secrets Operator that allows unauthorized file reads and credential exfiltration from the operator pod.
The vulnerability affects Vault Secrets Operator versions 1.3.0 to 1.4.1.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could lead to unauthorized access to sensitive files and privilege escalation within the Kubernetes cluster.
You can mitigate the risk by adjusting Kubernetes RBAC permissions to limit access to the AppRole secretIDPath.
References
Related vulnerabilities
Recent vulnerabilities recorded for consul.
