HashiCorp Consul CVE-2026-19016

Exploitation requires an authenticated Consul principal with any valid ACL token (PR:L) and network-level access to the Consul server's HTTP or RPC API endpoint. The critical condition is that the session deletion must be submitted via the transaction API (PUT /v1/txn) rather than the standard session delete endpoint - the standard endpoint correctly enforces session:write. A legitimate session:write-holding caller is unaffected (they already have permission); the vulnerability is meaningful only when the caller lacks that permission. Exploitation is limited by: (1) requirement for valid Consul credentials - unauthenticated callers cannot exploit this; (2) the attacker must know the session IDs to target, which requires either prior read access or enumeration; (3) affected version range is bounded to 1.19.1-2.0.2; (4) AC:H reflects that the attacker must specifically route through the transaction API, which is not the default or simplest deletion path.

The NVD CVSS 3.1 score of 4.2 (Medium) is consistent with the actual impact profile: network-reachable (AV:N), but requiring existing low-privilege authentication (PR:L), high attack complexity (AC:H implying the attacker must specifically know to route deletion through the transaction API rather than the standard endpoint), and limited impact (I:L, A:L only - no confidentiality exposure). EPSS data was not supplied; given the absence of KEV listing and public exploit code, opportunistic mass exploitation is unlikely. The realistic threat is a malicious insider or a compromised low-privilege service account deliberately abusing the transaction API to disrupt Consul sessions for other services or users - forcing re-authentication or breaking session-dependent workflows. The CWE-22 tag and the narrow version window (1.19.1-2.0.2) further constrain scope. Overall, this is a genuine but contained authorization gap rather than a critical priority; organizations running Consul in multi-tenant or highly regulated environments should treat it with higher urgency.

An attacker with a valid but minimally privileged Consul ACL token - such as a service account that lacks session:write - crafts a transaction API request (PUT /v1/txn) containing a session deletion operation targeting sessions owned by other services or users. Because the transaction code path skips the required ACL check, the deletion succeeds, forcing affected services to re-establish sessions and potentially disrupting leader election, lock-based workflows, or health-check coordination that depend on those sessions. No public proof-of-concept has been identified, but the technique requires only knowledge of the Consul transaction API documentation.