HashiCorp Consul CVE-2026-19014

Exploitation requires authenticated network access to the Consul agent's Connect authorization endpoint with at least low-privilege credentials (confirmed by CVSS PR:L). The vulnerability specifically bypasses operator-configured cache-disable settings - environments where cache-disable has been explicitly set as an operational or security control are at greatest risk of having their intent subverted, as the flaw allows callers to populate the cache regardless. Environments that have not configured cache-disable are still vulnerable to unbounded cache growth but do not experience the configuration bypass aspect. Key limiting factors: unauthenticated callers cannot trigger this endpoint; the availability impact is partial (A:L), suggesting memory exhaustion occurs gradually rather than via immediate crash; and the scope is unchanged (S:U), meaning the impact is confined to the targeted Consul agent rather than propagating across the broader system.

The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, score 4.3 Medium) is consistent with the described impact: network-accessible, low complexity, requiring only low-privilege authentication, with limited availability impact and zero confidentiality or integrity exposure. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified against baseline rates. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified - exploitation status is unconfirmed. Real-world priority is moderate: the primary concern is insider threat or compromised service accounts within the Consul mesh exploiting the flaw to degrade authorization performance. The secondary - and arguably more significant - concern is the bypass of an operator-configured security or operational control (cache-disable), which undermines the principle that explicitly disabled features remain disabled. For environments that have not configured cache-disable, the risk is narrowed to resource exhaustion only. No SSVC signals indicate automated or widespread exploitation.

An authenticated service account within the Consul service mesh - whether legitimately credentialed or compromised - makes high-volume or specially crafted repeated calls to the Connect authorization endpoint. Each call adds entries to the agent's intention-match cache without any upper bound being enforced, causing the agent process to consume progressively more memory. Over a sustained attack window, this degrades the Consul agent's responsiveness to legitimate service mesh authorization requests across the cluster.