CVE-2026-15970 Details
Description
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
A vulnerability exists in HashiCorp Consul Community Edition and Consul Enterprise versions 1.20.1 through 2.0.2, allowing an L7 intention authorization bypass. This issue arises when a service proxy is set up with a custom public listener, enabling an authenticated mesh workload to access HTTP paths that a path-based deny intention should block. The vulnerability is present in services using 'envoy_public_listener_json' with path-based L7 deny intentions, while those with standard listener configurations are unaffected.
The vulnerability is fixed in Consul version 2.0.3 and Consul Enterprise versions 1.21.17, 1.22.11, and 2.0.3. Customers should consider upgrading to these versions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |