CVE-2026-19016 in Consul
Summary
by MITRE • 08/07/2026
Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described in CVE-2026-19016 represents a critical access control flaw within HashiCorp Consul's authentication and authorization framework. This issue affects both Community Edition and Enterprise versions across a specific range, demonstrating how seemingly minor configuration oversight can lead to significant security implications in distributed systems. The flaw exists in the transaction API implementation where session deletion operations bypass proper ACL permission checking, creating an unauthorized access vector that could be exploited by malicious actors with network connectivity to Consul server RPC ports.
The technical root cause of this vulnerability lies in the inconsistent enforcement of ACL permissions within the transaction processing subsystem. Specifically, when session deletion requests are submitted through the transaction API rather than direct session endpoints, the system fails to validate whether the authenticated caller possesses the required {{session:write}} ACL permission. This creates a privilege escalation pathway where authenticated users can manipulate session state without proper authorization, effectively undermining the entire access control model that Consul implements. The issue stems from a design oversight in the transaction API handler where it processes session operations without consulting the standard ACL permission checking mechanisms that would normally validate such actions.
The operational impact of this vulnerability extends beyond simple unauthorized session deletion, as sessions in Consul serve critical functions including leader election, service coordination, and distributed locking mechanisms. An attacker exploiting this flaw could potentially disrupt service availability by deleting active sessions, manipulate leader elections, or interfere with distributed consensus operations that depend on proper session management. The vulnerability affects systems where Consul is used for service discovery, configuration management, and infrastructure orchestration, making it particularly dangerous in production environments where these services are critical to business operations. This issue represents a direct violation of the principle of least privilege and could enable attackers to gain unauthorized control over distributed system coordination primitives.
Security researchers have classified this vulnerability according to CWE-284, which addresses improper access control within software systems, and it aligns with ATT&CK technique T1078 for valid accounts and privilege escalation. Organizations running affected versions of Consul face significant risk as the vulnerability allows attackers with basic network connectivity to perform session manipulation operations that could compromise system integrity and availability. The fix implemented in Consul 2.0.3 and Enterprise versions 1.21.17, 1.22.11, and 2.0.3 addresses this by ensuring consistent ACL validation across all session deletion pathways, including those processed through the transaction API.
Organizations should immediately upgrade to the patched versions of Consul to remediate this vulnerability and implement comprehensive monitoring for unauthorized session deletion attempts. The patch ensures that all session operations through the transaction API now properly validate {{session:write}} permissions before executing any destructive operations. Security teams should also review existing ACL policies to ensure appropriate privilege levels are assigned to users and services, and consider implementing additional network segmentation controls to limit access to Consul RPC ports. Regular security audits of distributed system components should include verification of ACL enforcement mechanisms to prevent similar oversight issues in other API endpoints.