CVE-2026-19016: HashiCorp Consul Auth Bypass Vulnerability

CVE-2026-19016 Overview

CVE-2026-19016 is a missing authorization vulnerability in HashiCorp Consul Community Edition and Consul Enterprise. Affected versions did not enforce the session:write Access Control List (ACL) permission for session deletion operations submitted through the transaction API. Authenticated callers with network access to the Consul server Remote Procedure Call (RPC) port can delete arbitrary sessions without holding the required permission. The flaw is classified under [CWE-22] and affects service coordination workflows that rely on Consul sessions for distributed locking and health tracking. HashiCorp addressed the issue in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Critical Impact
Authenticated users can delete arbitrary Consul sessions through the transaction API, breaking distributed locks and service coordination without holding session:write permissions.

Affected Products

HashiCorp Consul Community Edition 1.19.1 through 2.0.2
HashiCorp Consul Enterprise 1.19.1 through 2.0.2
Consul deployments exposing the server RPC port to authenticated clients

Discovery Timeline

2026-08-07 - CVE-2026-19016 published to the National Vulnerability Database
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-19016

Vulnerability Analysis

Consul uses sessions to coordinate distributed locks, service health checks, and key-value store operations. ACLs govern which tokens can create, read, or destroy those sessions. The transaction API (/v1/txn) allows callers to batch multiple operations, including session deletions, into a single atomic request.

Affected releases skipped the session:write permission check on session deletion operations routed through this transaction endpoint. Non-transactional session deletion paths correctly validated the permission, but the transaction handler did not apply equivalent enforcement. Any authenticated caller with a valid ACL token and network reach to the server RPC port could bypass the intended authorization boundary.

Root Cause

The root cause is missing authorization on a code path handling session deletion inside the transaction API. Session delete operations submitted through /v1/txn were processed without validating that the caller's ACL token held session:write for the target session. This is a broken access control defect where one API path enforces a permission while an equivalent path does not.

Attack Vector

An authenticated attacker with any valid ACL token and network access to the Consul server RPC port crafts a transaction request containing session delete operations. The server processes the deletions without verifying session:write. Deleting sessions releases the locks they hold, invalidates associated health checks, and disrupts service coordination for the affected keys and services. Exploitation requires an authenticated token and network path, but no elevated permissions.

See the HashiCorp Security Advisory HCSEC-2026-25 for vendor technical details.

Detection Methods for CVE-2026-19016

Indicators of Compromise

Unexpected SessionDestroy or session delete operations in Consul audit logs originating from tokens that do not hold session:write
Sudden loss of distributed locks or leader elections across services that depend on Consul sessions
Bursts of transaction API requests (/v1/txn) containing session delete verbs from unusual client identities

Detection Strategies

Enable Consul audit logging on Enterprise deployments and alert on session deletion events correlated with the token's declared permissions
Compare token policies against observed session delete activity to identify tokens performing actions outside their granted permissions
Monitor for anomalous volume of transaction API calls that include session operations

Monitoring Recommendations

Forward Consul server logs and audit records to a centralized analytics platform for correlation with authentication and network telemetry
Track health check state transitions and lock churn as secondary signals of session tampering
Alert on RPC port (8300/tcp) connections from clients outside the expected service mesh perimeter

How to Mitigate CVE-2026-19016

Immediate Actions Required

Upgrade Consul Community Edition to 2.0.3 or later
Upgrade Consul Enterprise to 1.21.17, 1.22.11, or 2.0.3 depending on the deployment track
Rotate ACL tokens that may have been used to exploit the transaction API and review recent session deletion events
Restrict network access to the Consul server RPC port to trusted clients only

Patch Information

HashiCorp fixed the missing ACL enforcement in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. The patched releases apply the session:write check to session deletion operations submitted through the transaction API, aligning enforcement with the non-transactional path. Refer to HashiCorp Security Advisory HCSEC-2026-25 for release notes and upgrade guidance.

Workarounds

Limit ACL token issuance so that only trusted services hold tokens capable of reaching the transaction API
Enforce network segmentation between application tiers and Consul server RPC ports using firewall or service mesh policies
Enable and monitor Consul audit logging to detect misuse until patches are applied

bash

# Verify running Consul version and plan upgrade
consul version

# Restrict RPC port exposure with host firewall (example: iptables)
iptables -A INPUT -p tcp --dport 8300 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8300 -j DROP