CVE-2026-19012
published 2026-08-07CVE-2026-19012: Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition…
PriorityP430medium5.3CVSS 3.1
AVNACHPRLUINSUCNINAH
EPSS
0.33%
24.6th percentile
Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. This vulnerability, CVE-2026-19012, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hashicorp | consul | >= 1.18.0 < 2.0.3 | 2.0.3 |
| hashicorp | consul_enterprise | >= 1.18.0 < 2.0.3 | 2.0.3 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
consul: Consul: Authenticated denial of service via configuration entry
vendor_redhat·2026-08-07·CVSS 5.3
CVE-2026-19012 [MEDIUM] CWE-15 consul: Consul: Authenticated denial of service via configuration entry
consul: Consul: Authenticated denial of service via configuration entry
Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. This vulnerability, CVE-2026-19012, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
A flaw was found in Consul. An authenticated attacker with config-entry write permission can exploit a vulnerability in the Enterprise-to-Community Edition downgrade path. By submitting a specially crafted service-router configuration entr
VulDB
HashiCorp Consul/Consul Enterprise up to 2.0.2 Service Router denial of service
vuldb·2026-08-07·CVSS 5.3
CVE-2026-19012 [MEDIUM] HashiCorp Consul/Consul Enterprise up to 2.0.2 Service Router denial of service
A vulnerability has been found in HashiCorp Consul and Consul Enterprise up to 2.0.2 and classified as problematic. Affected is an unknown function of the component Service Router. The manipulation leads to denial of service.
This vulnerability is traded as CVE-2026-19012. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authori
ghsa_unreviewed·2026-08-07·CVSS 5.3
CVE-2026-19012 [MEDIUM] CWE-476 Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authori
Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. This vulnerability, CVE-2026-19012, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
No detection rules found.
No public exploits indexed.
2026-08-07
Published