CVE-2026-15970
Received Received - Intake

Authorization Bypass in Consul via L7 Proxy

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HashiCorp Inc.

Description
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-15970
EUVD
EUVD-2026-54611

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
hashicorp consul 1.20.1
hashicorp consul 1.20.2
hashicorp consul 2.0.2
hashicorp consul From 1.20.1 (inc) to 2.0.2 (inc)
hashicorp consul 2.0.3
hashicorp consul_enterprise 1.21.17
hashicorp consul_enterprise 1.22.11
hashicorp consul_enterprise 2.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-647 The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Consul Community Edition and Consul Enterprise versions 1.20.1 through 2.0.2 have a flaw where an authenticated mesh workload can bypass path-based deny intentions when a service proxy uses a custom public listener. This allows unauthorized access to HTTP paths that should be blocked.

Detection Guidance

To detect CVE-2026-15970, check if your Consul version is between 1.20.1 and 2.0.2. Verify if a service proxy is configured with a custom public listener. Inspect intentions for path-based deny rules that may be bypassed. No specific commands are provided in the context.

Impact Analysis

An attacker with access to the mesh could reach restricted HTTP paths, potentially exposing sensitive data or performing unauthorized actions. The impact is limited as it requires authentication and specific proxy configurations.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Consul versions may face compliance risks if sensitive data is exposed.

Mitigation Strategies

Upgrade Consul Community Edition to version 2.0.3 or Consul Enterprise to versions 1.21.17, 1.22.11, or 2.0.3 to address the L7 intention authorization bypass vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15970. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart