Hashicorp Consul vulnerabilities

CVE-2026-19113 [MEDIUM] CWE-400 CVE-2026-19113: Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthentica Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17,

CVE-2026-19012 [MEDIUM] CWE-476 CVE-2026-19012: Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticat Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a service-router configuration entry that causes the agen

CVE-2018-19653 [MEDIUM] CWE-310 CVE-2018-19653: HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.

CVE-2020-12797 [MEDIUM] CVE-2020-12797: HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to no HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

CVE-2026-19016 [MEDIUM] CWE-22 CVE-2026-19016: Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-20

CVE-2024-10086 [MEDIUM] CWE-79 CVE-2024-10086: A vulnerability was identified in Consul and Consul Enterprise such that the server response did not A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

CVE-2020-7955 [MEDIUM] CWE-863 CVE-2020-7955: HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

CVE-2026-15970 [MEDIUM] CWE-647 CVE-2026-15970: Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intentio Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3

CVE-2026-19014 [MEDIUM] CWE-770 CVE-2026-19014: Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolle Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in

CVE-2026-105608 [HIGH] CWE-178 CVE-2026-105608: HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh pro HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enter

CVE-2026-105765 [HIGH] CWE-862 CVE-2026-105765: HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and

CVE-2026-105626 [HIGH] CWE-770 CVE-2026-105626: HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that ma HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

CVE-2026-115804 [MEDIUM] CWE-639 CVE-2026-115804: HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check reg HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.