HashiCorp Consul CVE-2026-19015

The Consul Connect feature (service mesh) must be in active use, as the vulnerability resides specifically in the Connect CA roots endpoint - Consul deployments that do not use Connect are not exposed. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates that no authentication is required and no special client configuration is needed, meaning any network-reachable caller can trigger cache growth. Exploitation is limited by the requirement that the Consul HTTP API (typically port 8500 or 8501 for TLS) must be reachable from the attacker's position; organizations that restrict Consul API access to internal networks or trusted clients significantly reduce realistic exposure. The impact ceiling is bounded to availability degradation of the individual Consul agent rather than full cluster compromise.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L characterizes this as a low-complexity, network-accessible, unauthenticated denial-of-service primitive with only partial (low) availability impact. Real-world risk is constrained to environments where the Connect service mesh feature is active and the CA roots endpoint is reachable - deployments not using Connect are not exposed to this attack surface. There is no confidentiality or integrity impact; the worst case is memory exhaustion degrading agent stability. No EPSS data was provided in the intelligence sources, and the vulnerability is not listed in the CISA KEV catalog, nor is there known public exploit code, all of which reduce urgency relative to other unpatched network-accessible issues. The risk is real but bounded: a determined attacker could sustain cache growth to degrade a Consul agent, but immediate cluster-wide compromise is not a plausible outcome from this vector alone.

An unauthenticated remote attacker with network access to a Consul agent's HTTP API repeatedly calls the Connect CA roots endpoint in a tight loop, causing the in-memory cache to grow without bound despite any operator-configured cache limits. Over time, escalating memory consumption degrades Consul agent responsiveness or triggers an out-of-memory condition, disrupting service discovery and mTLS for the service mesh. No public proof-of-concept code has been identified at the time of this analysis.