CVE-2026-19012 Overview
CVE-2026-19012 is an authenticated denial-of-service vulnerability affecting HashiCorp Consul Community Edition and Consul Enterprise versions 1.18.0 through 2.0.2. The flaw resides in the Enterprise-to-Community Edition downgrade path. An authorized caller holding config-entry:write permission can submit a crafted service-router configuration entry that forces the Consul agent to exit unexpectedly. The issue is tracked under [CWE-476] (NULL Pointer Dereference) and is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Critical Impact
An authenticated caller with configuration-write permission can crash Consul server nodes, disrupting service discovery, health checking, and service mesh operations across dependent workloads.
Affected Products
- HashiCorp Consul Community Edition 1.18.0 through 2.0.2
- HashiCorp Consul Enterprise 1.18.0 through 2.0.2
- Consul deployments using the Enterprise-to-Community Edition downgrade path with service-router configuration entries
Discovery Timeline
- 2026-08-07 - CVE-2026-19012 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-19012
Vulnerability Analysis
HashiCorp Consul provides service networking, discovery, and health checking across distributed infrastructure. The service-router configuration entry defines Layer 7 traffic routing rules used by the Consul service mesh. This vulnerability appears when Consul processes a service-router entry along the Enterprise-to-Community Edition downgrade code path.
When the affected code path evaluates a specific configuration shape, it dereferences a pointer that was never initialized. The agent process terminates immediately, and clustered Consul servers lose the affected node from quorum. Repeated submission of the malicious configuration entry keeps the target servers in a crash loop.
The attacker must already hold ACL privileges to write configuration entries. This limits the exposure to insider misuse, compromised operator tokens, or environments where ACL policies are overly permissive. Because Consul underpins service discovery and mesh routing, an agent crash cascades into upstream application failures.
Root Cause
The root cause is a NULL pointer dereference ([CWE-476]) in the code path that translates Enterprise configuration entries into Community Edition-compatible structures. Fields expected to be populated by Enterprise-only logic remain nil under specific input, and the downgrade handler does not validate the field before dereferencing it.
Attack Vector
Exploitation requires network access to the Consul API and an ACL token granting config-entry:write on a service targeted by the crafted router. The attacker submits a malicious service-router entry via the HTTP configuration API. Consul processes the entry, triggers the NULL dereference, and the agent exits. No user interaction is required.
Exploitation code is not publicly available, and CVE-2026-19012 is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability is described in the HashiCorp Security Advisory HCSEC-2026-25.
Detection Methods for CVE-2026-19012
Indicators of Compromise
- Unexpected consul agent process termination correlated with recent PUT /v1/config requests targeting service-router kinds
- Repeated crash-loop entries in systemd or container orchestrator logs for Consul server nodes
- Raft leadership changes and quorum instability following configuration API writes from a single token identity
Detection Strategies
- Audit Consul HTTP API logs for PUT requests to /v1/config with Kind=service-router and correlate with agent restarts occurring within seconds of the request
- Alert on Consul agent exit codes and abnormal termination signals emitted by the host process manager
- Track ACL token usage to identify tokens submitting configuration entries outside expected change-management windows
Monitoring Recommendations
- Forward Consul audit logs and host process telemetry to a centralized analytics platform for correlation across cluster members
- Baseline the rate of service-router writes per token and alert on deviations
- Monitor Raft health metrics (consul.raft.state.leader, consul.raft.peers) for unexpected transitions following configuration API activity
How to Mitigate CVE-2026-19012
Immediate Actions Required
- Upgrade Consul Community Edition to 2.0.3 and Consul Enterprise to 1.21.17, 1.22.11, or 2.0.3 as appropriate for the deployed track
- Review and restrict ACL policies granting config-entry:write, limiting the permission to trusted operators and automation identities
- Rotate any ACL tokens that may have been exposed to untrusted parties
Patch Information
HashiCorp resolved CVE-2026-19012 in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. Patch notes and download links are available in the HashiCorp Security Advisory HCSEC-2026-25.
Workarounds
- Enforce least-privilege ACL policies so that only vetted service identities can write service-router configuration entries
- Restrict network access to the Consul HTTP and RPC ports using host firewalls or service mesh policies until patched versions are deployed
- Require change-management review and approval for configuration entry writes in production clusters
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
