Skip to content

Fix for arbitrary file reads vulnerabilities#23249

Merged
santoshpulluri merged 5 commits intomainfrom
sec_vul_arb_file_read
Feb 23, 2026
Merged

Fix for arbitrary file reads vulnerabilities#23249
santoshpulluri merged 5 commits intomainfrom
sec_vul_arb_file_read

Conversation

@santoshpulluri
Copy link
Copy Markdown
Contributor

@santoshpulluri santoshpulluri commented Feb 23, 2026

Description

This PR fixes a security vulnerability in the Vault CA provider's authentication methods (Kubernetes, JWT, and AppRole) that allowed arbitrary file reads through path traversal attacks.

Root Cause:

The auth providers used os.ReadFile() directly on user-supplied file paths without proper validation, allowing attackers to read any file on the system by manipulating configuration parameters:

Solution

Implemented OS-level path traversal protection using Go's os.OpenRoot() function, which creates a chroot-like restriction preventing access outside designated directories.

Security Measures:

Whitelist Validation: Only allow file reads from pre-defined standard directories
OS-Level Enforcement: Use os.OpenRoot() to prevent path traversal and symlink escapes at the kernel level
Defense in Depth: Multiple layers of validation ensure security even if one layer has bugs

Allowed Directories:

  1. Kubernetes Auth

    • /var/run/secrets/kubernetes.io/serviceaccount
    • /run/secrets/kubernetes.io/serviceaccount

  2. JWT Auth

    • /var/run/secrets/kubernetes.io/serviceaccount
    • /run/secrets/kubernetes.io/serviceaccount
    • /var/run/secrets
    • /run/secrets

  3. AppRole Auth:

    • /var/run/secrets/vault
    • /run/secrets/vault
    • /var/run/secrets
    • /run/secrets

Testing:

Tests use symbolic links from allowed directories to temporary test directories, respecting the security boundaries while enabling test execution.

@santoshpulluri santoshpulluri requested review from a team as code owners February 23, 2026 12:58
@github-actions github-actions bot added the theme/connect Anything related to Consul Connect, Service Mesh, Side Car Proxies label Feb 23, 2026
@santoshpulluri santoshpulluri added the backport/all Apply backports for all active releases per .release/versions.hcl label Feb 23, 2026
anilvpatel
anilvpatel approved these changes Feb 23, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@anilvpatel anilvpatel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@santoshpulluri santoshpulluri merged commit 7054efd into main Feb 23, 2026
98 checks passed
@santoshpulluri santoshpulluri deleted the sec_vul_arb_file_read branch February 23, 2026 13:42
@hc-github-team-consul-core hc-github-team-consul-core added backport/1.22 Changes are backported to 1.22 backport/ent/1.18 Changes are backported to 1.18 ent backport/ent/1.21 changes are backported to 1.21 ent labels Feb 23, 2026
@hc-github-team-consul-core hc-github-team-consul-core mentioned this pull request Feb 23, 2026
Draft
@santoshpulluri santoshpulluri added backport/ent/1.22 Changes are backported to 1.22 ent backport/ent/1.21 changes are backported to 1.21 ent backport/all Apply backports for all active releases per .release/versions.hcl and removed backport/all Apply backports for all active releases per .release/versions.hcl backport/ent/1.18 Changes are backported to 1.18 ent backport/ent/1.21 changes are backported to 1.21 ent backport/1.22 Changes are backported to 1.22 labels Feb 23, 2026
@hc-github-team-consul-core hc-github-team-consul-core added backport/1.22 Changes are backported to 1.22 backport/ent/1.18 Changes are backported to 1.18 ent labels Feb 23, 2026
@santoshpulluri santoshpulluri added backport/1.22 Changes are backported to 1.22 and removed backport/1.22 Changes are backported to 1.22 labels Feb 23, 2026
This was referenced Feb 23, 2026
Draft
Merged
@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 5, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

29 similar comments
@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 6, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 7, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 8, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 9, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 10, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 11, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 12, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 13, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 14, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 15, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 16, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 17, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 18, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 19, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 20, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 21, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 23, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 26, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 27, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 28, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 29, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Mar 30, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Apr 1, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Apr 2, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Apr 3, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Apr 4, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Apr 5, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Apr 6, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

hc-github-team-consul-core commented Apr 7, 2026

📣 Hi @santoshpulluri! a backport is missing for this PR [23249] for versions [1.18,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anilvpatel anilvpatel anilvpatel approved these changes

Assignees

No one assigned

Labels

backport/ent/1.18 Changes are backported to 1.18 ent backport/ent/1.21 changes are backported to 1.21 ent backport/ent/1.22 Changes are backported to 1.22 ent backport/1.22 Changes are backported to 1.22

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@santoshpulluri @hc-github-team-consul-core @dduzgun-security @anilvpatel @sanikachavan5