Description

Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. This vulnerability, CVE-2026-19012, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-07T20:16:50.143Z",
  "pubdate": "2026-08-07T20:16:50.143Z",
  "executiveSummary": "CVE-2026-19012 describes an authenticated denial of service vulnerability affecting HashiCorp Consul Community Edition and Consul Enterprise versions 1.18.0 through 2.0.2. The vulnerability resides within the Enterprise-to-Community Edition downgrade path, specifically impacting the handling of service-router configuration entries. An authenticated caller possessing config-entry write permissions can submit a maliciously crafted service-router configuration entry that forces the Consul server process to terminate unexpectedly, resulting in an unscheduled outage of the affected agent. This flaw represents a significant operational risk to service mesh stability, as it allows internal actors or compromised accounts with specific service mesh configuration privileges to repeatedly crash core infrastructure nodes, thereby disrupting service discovery and routing operations across the cluster. Successful exploitation requires prior authentication and specific authorization levels, limiting the attack surface to trusted identities or compromised credentials holding config-entry write privileges. HashiCorp has addressed this vulnerability in Consul versions 2.0.3, Consul Enterprise 1.21.17, and Consul Enterprise 1.22.11.",
  "technicalDetails": "The vulnerability is classified as an authenticated denial of service affecting Consul Community Edition and Consul Enterprise versions 1.18.0 through 2.0.2. The root cause stems from improper input validation and exception handling within the Enterprise-to-Community Edition downgrade path when processing specific configuration entries.\nThe vulnerable component responsible for this behavior is the Consul configuration entry subsystem, specifically the parser and state manager handling service-router configurations. When an authorized caller submits a service-router configuration entry designed to trigger edge-case parsing logic or unsupported state transitions unique to the downgrade path, the internal state machine encounters an unhandled exception.\nThe attack flow proceeds as follows: First, the attacker authenticates to the Consul cluster using credentials or tokens that grant config-entry write permissions. Second, the attacker interacts with the Consul configuration API or CLI to create or update a service-router configuration entry containing the malicious payload. Third, upon receiving and processing the configuration entry, the Consul agent's internal evaluation logic triggers the vulnerable code path within the Enterprise-to-Community Edition downgrade mechanism. Finally, the unhandled runtime condition forces the Consul server process to exit unexpectedly, terminating the agent daemon and causing a denial of service.\nExploitation requirements dictate that the caller must possess valid credentials capable of authenticating to the Consul cluster and must hold specific authorization permissions, namely config-entry write privileges. The network exposure is dictated by the accessibility of the Consul API port, typically port 8500. The post-exploitation impact is strictly limited to availability, manifesting as an abrupt crash of the targeted Consul server instance, which can lead to cascading service discovery failures if multiple control plane nodes are targeted concurrently."
}