EUVD-2026-54606
GHSA-hh64-grcp-prv8
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Network API access requires authenticated low-privilege write permission and a specific Enterprise downgrade state (AC:H, PR:L); impact is availability-only with no scope change.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
3DescriptionCVE.org
Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. This vulnerability, CVE-2026-19012, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
AnalysisAI
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a network attacker holding config-entry write permission to crash the Consul server agent by submitting a crafted service-router configuration entry. The flaw is rooted in a null pointer dereference (CWE-476) triggered along the Enterprise-to-Community Edition downgrade code path, meaning only deployments undergoing or having undergone that transition are exploitable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target Consul deployment must be in, or have passed through, the Enterprise-to-Community Edition downgrade path - deployments that have never run Consul Enterprise are not exposed; (2) the attacker must hold a valid identity with config-entry write permission on the Consul ACL system, meaning unauthenticated exploitation is ruled out by CVSS PR:L; and (3) the Consul HTTP API must be network-reachable from the attacker's position, consistent with CVSS AV:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 (Medium) reflects genuine mitigating factors: AC:H indicates that exploitation requires a specific non-default operational state (the Enterprise-to-Community downgrade path), and PR:L confirms that a low-privileged but authenticated caller is required - the attack is not open to anonymous actors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to Consul 2.0.3 (Community Edition) or Consul Enterprise 1.21.17, 1.22.11, or 2.0.3, all confirmed by HashiCorp advisory HCSEC-2026-25 at https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Consul Enterprise
View allUnauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expan
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated ne
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated caller
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an a
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today