CVE-2026-15970: Consul Auth Bypass Vulnerability

CVE-2026-15970 Overview

CVE-2026-15970 is an authorization bypass vulnerability in HashiCorp Consul Community Edition and Consul Enterprise. The flaw affects versions 1.20.1 through 2.0.2 when a service proxy is configured with a custom public listener. Authenticated mesh workloads can reach HTTP paths that a path-based L7 deny intention should block. The issue maps to CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions. HashiCorp addressed the vulnerability in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Critical Impact
Authenticated workloads inside the service mesh can bypass path-based deny intentions and reach protected HTTP endpoints on peer services.

Affected Products

HashiCorp Consul Community Edition 1.20.1 through 2.0.2
HashiCorp Consul Enterprise 1.20.1 through 2.0.2
Service proxies configured with a custom public listener

Discovery Timeline

2026-08-07 - CVE-2026-15970 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-15970

Vulnerability Analysis

Consul enforces service-to-service access controls through intentions. L7 intentions allow operators to permit or deny traffic based on HTTP attributes such as request paths, methods, and headers. When an operator writes a path-based deny intention, the sidecar proxy is expected to reject matching HTTP requests before they reach the upstream service.

This vulnerability breaks that guarantee when a service proxy uses a custom public listener. Under that configuration, the proxy does not correctly apply the path-based deny rule, and requests that should be blocked instead reach the destination service. Any authenticated workload with a valid mesh identity can leverage this behavior to access endpoints that policy intended to restrict.

Exploitation requires an existing foothold inside the mesh and a target service configured with a custom public listener, which limits practical attack surface. The impact is limited to confidentiality and integrity of resources gated behind path-based intentions.

Root Cause

The root cause is inconsistent enforcement of L7 authorization when the proxy configuration overrides the default public listener. The custom listener path bypasses the filter chain that evaluates path-based intentions, so authorization decisions are made on an incomplete view of the request. This aligns with CWE-647, where path handling for authorization does not match the canonical enforcement logic.

Attack Vector

An authenticated mesh workload sends HTTP requests to a peer service whose proxy is configured with a custom public listener. Requests targeting HTTP paths covered by a deny intention pass through the proxy without being rejected. See the HashiCorp Security Advisory HCSEC-2026-25 for vendor-provided technical details.

Detection Methods for CVE-2026-15970

Indicators of Compromise

Successful HTTP responses on paths that a path-based deny intention should block
Proxy access logs showing requests to restricted paths without corresponding RBAC: denied filter events
Consul configuration entries deploying custom public listeners on affected proxy versions

Detection Strategies

Compare declared L7 intentions against observed proxy access logs to surface requests that reached denied paths
Audit service-defaults and proxy-defaults configuration entries for custom public listener definitions on vulnerable Consul versions
Correlate mesh workload identities with unexpected access to sensitive HTTP routes on peer services

Monitoring Recommendations

Ingest Envoy or Consul dataplane access logs into a centralized analytics platform and alert on 2xx responses to policy-denied paths
Track Consul version inventory and flag any deployment running 1.20.1 through 2.0.2
Monitor intention updates and custom listener changes for drift from approved baselines

How to Mitigate CVE-2026-15970

Immediate Actions Required

Upgrade Consul Community Edition to 2.0.3 and Consul Enterprise to 1.21.17, 1.22.11, or 2.0.3
Inventory service proxies using custom public listeners and prioritize them for patching
Review path-based deny intentions and validate enforcement after upgrade with targeted test requests

Patch Information

HashiCorp fixed CVE-2026-15970 in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. Refer to the HashiCorp Security Advisory HCSEC-2026-25 for release notes and upgrade guidance.

Workarounds

Where feasible, remove custom public listener configuration and revert to the default Consul-managed listener until proxies are upgraded
Enforce coarser service-level deny intentions that block the offending source workload entirely, rather than relying on path-based rules alone
Add upstream application-layer authorization checks on sensitive HTTP paths as defense in depth

bash

# Verify Consul version and upgrade to a fixed release
consul version

# Example upgrade path for Consul CE
# Replace with the appropriate package manager for your distribution
apt-get update && apt-get install --only-upgrade consul=2.0.3

# Validate that path-based intentions are enforced after upgrade
consul intention get <source-service> <destination-service>