EUVD-2026-54606
GHSA-hh64-grcp-prv8
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Network API access requires authenticated low-privilege write permission and a specific Enterprise downgrade state (AC:H, PR:L); impact is availability-only with no scope change.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
3DescriptionCVE.org
Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. This vulnerability, CVE-2026-19012, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
AnalysisAI
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a network attacker holding config-entry write permission to crash the Consul server agent by submitting a crafted service-router configuration entry. The flaw is rooted in a null pointer dereference (CWE-476) triggered along the Enterprise-to-Community Edition downgrade code path, meaning only deployments undergoing or having undergone that transition are exploitable. No public exploit code or active exploitation confirmed by CISA KEV has been identified; vendor-released patches are available and confirmed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Technical ContextAI
HashiCorp Consul is a widely-deployed service mesh and service discovery platform. The vulnerability resides in the processing of service-router configuration entries - a Consul L7 traffic management primitive - specifically along the code path invoked during a downgrade from Consul Enterprise to Consul Community Edition. CWE-476 (Null Pointer Dereference) indicates that a pointer is dereferenced without a null check when handling such an entry in this downgrade context, causing an unhandled exception and agent exit. Affected CPE identifiers are cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:* (Community Edition) and cpe:2.3:a:hashicorp:consul_enterprise:*:*:*:*:*:*:*:* (Enterprise), both spanning versions 1.18.0 through 2.0.2. The config-entry write API endpoint is network-accessible, consistent with CVSS AV:N, but requires authenticated low-privilege access (PR:L).
RemediationAI
The primary fix is to upgrade to Consul 2.0.3 (Community Edition) or Consul Enterprise 1.21.17, 1.22.11, or 2.0.3, all confirmed by HashiCorp advisory HCSEC-2026-25 at https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629. For deployments that cannot immediately upgrade, the most effective compensating control is to revoke or restrict config-entry write permissions to only highly trusted administrators or automated pipelines operating under strict change control - this eliminates the ability of lower-privilege callers to submit the triggering service-router entry, though it may impact legitimate L7 traffic management workflows. Additionally, organizations not performing or planning an Enterprise-to-Community Edition downgrade can confirm they are not on the vulnerable code path and deprioritize the patch, but should still upgrade as routine maintenance. There are no publicly documented mitigations beyond access control tightening at this time.
More in Consul Enterprise
View allAuthorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-wri
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communi
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete servi
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expan
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated ne
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated caller
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an a
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today