Vulnerability · Published Aug 7, 2026 · Assigned by HashiCorp
CVE-2026-19016Authorization bypass for session deletion in the transaction API
Medium 4.2
In plain English
A medium-severity path traversal in Consul from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | consul | no fix listed | UBUNTU-CVE-2026-19016 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Consul | 1.19.1 – before 2.0.3 |
| HashiCorp | Consul Enterprise | 1.19.1 – before 2.0.3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L