EUVD-2026-54605
GHSA-7qhj-3fg3-mh5r
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-reachable API (AV:N), but requires authenticated token (PR:L) and specific transaction API knowledge (AC:H); no confidentiality impact, only session integrity and availability affected.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
2DescriptionCVE.org
Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
AnalysisAI
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated callers to delete arbitrary sessions via the transaction API without holding the required session:write ACL permission. Any principal with valid credentials and network access to the Consul server's API can silently circumvent access controls that are correctly enforced on the standard session deletion endpoint. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low privilege barrier and straightforward API path make targeted misuse plausible in multi-tenant or shared Consul deployments.
Technical ContextAI
HashiCorp Consul provides a service mesh and key-value store protected by an ACL system; the session:write permission is meant to gate both creation and deletion of Consul sessions. The transaction API (PUT /v1/txn) supports atomic multi-operation requests across different resource types and, according to the CVE, did not re-validate ACL permissions when a session delete operation was included in a transaction payload - meaning the ACL gate present on the direct session deletion endpoint was absent in the transaction code path. Affected CPEs are cpe:2.3:a:hashicorp:consul:* and cpe:2.3:a:hashicorp:consul_enterprise:* in the 1.19.1-2.0.2 range. The assigned CWE-22 (Path Traversal) appears to be a metadata misclassification; the root cause is more precisely CWE-862 (Missing Authorization) - no path or directory traversal is involved. This discrepancy should be noted when correlating with scanner tooling that filters by CWE.
RemediationAI
The vendor-released fix is Consul Community Edition 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3; operators should upgrade to the appropriate fixed release as the primary remediation. Full advisory details are at https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629. If immediate upgrade is not possible, the most effective compensating control is to restrict network access to the Consul server's RPC and HTTP API ports (default 8300, 8500, 8501) to only trusted, explicitly authorized identities via firewall or network policy - this reduces the pool of principals who could abuse the transaction API, though it does not eliminate the flaw for those who already have access. Additionally, auditing Consul ACL tokens to ensure no low-privilege accounts have broader-than-necessary access limits blast radius. Neither workaround eliminates the underlying authorization gap.
More in Consul Enterprise
View allAuthorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-wri
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communi
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete servi
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expan
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a networ
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated ne
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an a
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today