CVE-2026-15970
published 2026-08-07CVE-2026-15970: Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured…
PriorityP424medium4.2CVSS 3.1
AVNACHPRLUINSUCLILAN
EPSS
0.21%
10.1th percentile
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hashicorp | consul | >= 1.20.1 < 2.0.3 | 2.0.3 |
| hashicorp | consul_enterprise | >= 1.20.1 < 2.0.3 | 2.0.3 |
CVSS provenance
nvdv3.14.2MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
vendor_redhat4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HashiCorp Consul/Consul Enterprise Service Proxy authorization
vuldb·2026-08-07·CVSS 4.2
CVE-2026-15970 [MEDIUM] HashiCorp Consul/Consul Enterprise Service Proxy authorization
A vulnerability was found in HashiCorp Consul and Consul Enterprise. It has been rated as critical. This vulnerability affects unknown code of the component Service Proxy. Performing a manipulation results in authorization bypass.
This vulnerability was named CVE-2026-15970. The attack may be initiated remotely. There is no available exploit.
GHSA
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener.
ghsa_unreviewed·2026-08-07·CVSS 4.2
CVE-2026-15970 [MEDIUM] CWE-647 Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener.
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Red Hat
consul: Consul: Authorization bypass via custom public listener
vendor_redhat·2026-08-07·CVSS 4.2
CVE-2026-15970 [MEDIUM] CWE-551 consul: Consul: Authorization bypass via custom public listener
consul: Consul: Authorization bypass via custom public listener
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
A flaw was found in Consul. When a service proxy is configured with a custom public listener, an authenticated user within the mesh network can bypass Layer 7 (L7) authorization intentions. This allows the user to access HTTP paths that should be blocked, potentially leading to unauthorized information disclosure or actions.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-15970 consul: Consul: Authorization bypass via custom public listener
bugzilla·2026-08-07·CVSS 4.2
CVE-2026-15970 [MEDIUM] CVE-2026-15970 consul: Consul: Authorization bypass via custom public listener
CVE-2026-15970 consul: Consul: Authorization bypass via custom public listener
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Wiz
CVE-2026-23852 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.8
CVE-2026-23852 [MEDIUM] CVE-2026-23852 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23852 :
Homebrew vulnerability analysis and mitigation
icon
/api/attr/setBlockAttrs
#15970
Source : NVD
## 5.8
Score
Published January 19, 2026
Severity MEDIUM
CNA Score 5.8
Affected Technologies
Homebrew
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 41
Exploitation Probability (EPSS) 0.2
Affected packages and libraries
siyuan
Sources
NVD
Homebrew Severity CRITICAL Has Fix Added at: Feb 02, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Homebrew vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Publish
2026-08-07
Published