HashiCorp Consul Vulnerability Advisory: Auth Bypass, DoS, File Read (CVE-2026-19012, 19014, 19015, 19017, 19016, 15970, 15972, 19113)

Vulnerability Overview Multiple security vulnerabilities exist in HashiCorp Consul Community Edition and Enterprise, including: 1. CVE-2026-19012: Authentication denial-of-service (DoS) vulnerability affecting the downgrade path from Enterprise Edition to Community Edition. 2. CVE-2026-19014: Uncontrolled resource consumption issue affecting the Connect auth endpoint. 3. CVE-2026-19015: Uncontrolled resource consumption issue affecting the Connect CA root endpoint. 4. CVE-2026-19017: Partial arbitrary file read vulnerability affecting deployments using Vault as the Connect CA provider. 5. CVE-2026-19016: Authorization bypass vulnerability in the transaction API, allowing session deletion. 6. CVE-2026-15970: L7 intention authorization bypass vulnerability affecting services using custom public listeners. 7. CVE-2026-15972: Unauthenticated denial-of-service vulnerability affecting external gRPC listeners. 8. CVE-2026-19113: Unauthenticated denial-of-service vulnerability affecting multiple agent HTTP API endpoints. Affected Versions Multiple versions of Consul Community Edition and Consul Enterprise are affected, specifically: 1.18.0 to 2.0.2 1.17.0 to 2.0.2 1.2.0 to 2.0.2 1.18.21 to 2.0.2 1.19.1 to 2.0.2 1.20.1 to 2.0.2 1.13.0 to 2.0.2 1.3.0 to 2.0.2 Remediation All vulnerabilities have been patched in the following versions: Consul Community Edition 2.0.3 Consul Enterprise 2.0.3, 1.22.11, and 1.21.17 Users are advised to upgrade to the aforementioned versions as soon as possible to mitigate these vulnerabilities. Related Code Snippets No specific Proof of Concept (PoC) code or exploit code is included on the page. Summary HashiCorp Consul contains multiple critical security vulnerabilities affecting numerous versions. Users are strongly recommended to upgrade to patched versions promptly to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

HashiCorp Consul Vulnerability Advisory: Auth Bypass, DoS, File Read (CVE-2026-19012, 19014, 19015, 19017, 19016, 15970, 15972, 19113)