CVE-2026-19016
Authorization bypass for session deletion in the transaction API
CVSS Score
4.2
EPSS Score
0.0%
EPSS Percentile
0th
Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
| CWE | CWE-22 |
| Vendor | hashicorp |
| Product | consul |
| Published | Aug 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for hashicorp consul
Be the first to know when new medium vulnerabilities affecting hashicorp consul are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
HashiCorp / Consul
1.19.1 < 2.0.3
HashiCorp / Consul Enterprise
1.19.1 < 2.0.3
References
Credits
This issue was reported by Andres Cruciani.