Medium6.8Red Hat Linux

Medium [CVE-2026-19017] Sensitive secret exfiltration via partial arbitrary file read

This medium-severity Red Hat Linux advisory covers CVE-2026-19017 affecting Red Hat Enterprise Linux 8, Red Hat package: grafana.

CVE-2026-19017 Published Aug 7, 2026Updated by vendor Aug 7, 2026

CVE-2026-19017

Affected products & platforms

Red Hat LinuxRed Hat Enterprise Linux

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication.

A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

A flaw was found in Consul. Red Hat severity: Moderate — CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 8.

Red Hat does not currently list a fixing RHSA for this CVE.

Affected products named by the advisory: Red Hat package: grafana.

Affected versions

1.18.21
2.0.2

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Fixed versions

2.0.3
1.21.17
1.22.11

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Mitigation

Upgrade to a fixed release: 2.0.3, 1.21.17, 1.22.11. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.