HashiCorp Consul EUVD-2026-54612

Exploitation requires that the Consul agent's external gRPC listener (default ports 8502 or 8503) is reachable from an attacker-controlled host over the network. No authentication is required - CVSS PR:N confirms this. No special configuration setting or non-default feature needs to be enabled beyond running a standard Consul 1.13.0-2.0.2 deployment with its gRPC listener active. What limits exploitation: deployments that firewall gRPC ports to trusted Consul agent subnets only are not practically exploitable from external networks; the attack requires sustained connection volume to maintain the DoS state and will recover if the flood ceases and the agent is not already crashed; only availability is impacted with no data exfiltration or code execution possible.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the real-world risk profile: network-accessible, trivially scriptable with no credential requirement, and capable of producing complete availability loss for the affected Consul agent. There is no confidentiality or integrity component. EPSS data was not included in the intelligence provided, so exploitation probability cannot be quantified from that source. Neither a CISA KEV listing nor a public POC was reported, suggesting this has not been observed in mass exploitation campaigns at time of analysis; however, the zero-complexity, zero-privilege attack surface means opportunistic exploitation is plausible once knowledge of the flaw is public. For organizations exposing Consul gRPC ports externally or across untrusted network segments, this is a genuine priority. For deployments where gRPC is firewalled to trusted hosts only, the practical risk is substantially reduced. The vendor patch is already available, which supports immediate remediation over workaround reliance.

An attacker identifies an internet- or intranet-exposed Consul agent gRPC port and uses a scripted tool to open thousands of TCP connections to that port, completing enough of the TLS or plaintext handshake to be accepted by the listener but never sending valid gRPC frames. Each connection holds a file descriptor and a goroutine in the Go runtime; as these accumulate, the agent's process-level resource pools are exhausted. No public exploit code has been confirmed, but the technique is a standard slow-open or connection-flood pattern that requires no specialized tooling.