EUVD-2026-54611
GHSA-h928-jqxm-5f3x
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
PR:L because a valid mesh workload credential is required; AC:H because a non-default custom public listener must be present; A:N because no availability impact is described.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
2DescriptionCVE.org
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
AnalysisAI
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an authenticated mesh workload to reach HTTP paths that are explicitly blocked by path-based deny intentions, when the service proxy is configured with a custom public listener. The flaw undermines a core service mesh security control - path-based L7 intentions - without requiring unauthenticated access or elevated privileges beyond mesh workload enrollment. No public exploit code has been identified and this CVE is not listed in CISA KEV; the CVSS 4.2 Medium score accurately reflects the configuration-dependent, authenticated nature of the attack.
Technical ContextAI
Consul's service mesh enforces inter-service access control through 'intentions', including L7 intentions that allow or deny traffic based on HTTP attributes such as path, header, and method. CWE-647 (Use of Non-Canonical URL Paths for Authorization Decisions) identifies the root cause class: the authorization engine fails to correctly evaluate HTTP paths when a proxy is configured with a custom public listener, likely because the listener alters how paths are presented to the intention evaluation logic, allowing non-canonical or crafted paths to evade deny rules. CPE identifiers cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:* and cpe:2.3:a:hashicorp:consul_enterprise:*:*:*:*:*:*:*:* confirm both the open-source and commercial editions across all platform variants are affected within the 1.20.1-2.0.2 range.
RemediationAI
The primary fix is to upgrade to Consul Community Edition 2.0.3 or Consul Enterprise 1.21.17, 1.22.11, or 2.0.3, as confirmed by HashiCorp's advisory HCSEC-2026-25 at https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629. If immediate patching is not feasible, the most targeted workaround is to audit and remove custom public listener configurations from service proxies that rely on L7 path-based deny intentions for security enforcement, as the vulnerability is conditional on this non-default configuration - removing it eliminates the bypass vector but may affect custom routing behavior. A secondary compensating control is to tighten mesh workload authentication and limit which services can enroll as mesh workloads, reducing the pool of potential authenticated attackers; however, this does not eliminate the path bypass itself and carries operational overhead.
More in Consul Enterprise
View allAuthorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-wri
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communi
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete servi
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expan
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a networ
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated ne
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated caller
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today