Description

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-07T20:16:50.273Z",
  "pubdate": "2026-08-07T20:16:50.273Z",
  "executiveSummary": "Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2 contain an uncontrolled resource consumption vulnerability within the Connect authorization endpoint. This security flaw allows an authenticated or unauthenticated caller, depending on configuration, to interact with the authorization subsystem in a manner that continuously populates and expands the agent's internal intention-match cache without bounds. Consequently, this behavior defeats any operator-configured cache-disable settings, leading to unmitigated memory exhaustion on the target host.\nThe primary impact of successful exploitation is severe resource depletion, specifically unbounded memory allocation that can precipitate agent crashes, service degradation, and potential denial-of-service (DoS) conditions across the affected Consul cluster nodes. The vulnerability poses significant operational risks to environments relying on Consul for service mesh security and routing. Attackers capable of issuing requests to the Connect authorization endpoint can trigger this condition repeatedly. The vulnerability requires network access to the vulnerable endpoint and is resolved by updating to the specified patched releases.",
  "technicalDetails": "The vulnerability resides within the Connect authorization endpoint component of HashiCorp Consul. The root cause stems from improper handling and caching logic for authorization queries within the affected software versions. Specifically, the subsystem fails to properly respect operator-defined constraints and cache-disable configurations, persistently storing evaluation results in the agent's intention-match cache regardless of administrative intent.\nDuring standard operation, the Connect authorization endpoint evaluates communication requests between service mesh instances against defined service intentions. In vulnerable builds, an attacker can dispatch a high volume of unique or crafted authorization queries designed to populate the intention-match cache. Because the caching mechanism lacks enforcement bounds and bypasses cache-disable directives, incoming requests continually allocate new cache entries in memory without eviction or pruning mechanisms mitigating the growth.\nThe attack flow proceeds as follows: 1) The attacker identifies network reachability to the Consul agent's Connect authorization endpoint. 2) The attacker transmits a continuous stream of requests that force the evaluation of distinct intention parameters. 3) The Consul agent processes these requests and caches the resulting match data in internal memory structures. 4) Due to the absence of size constraints and the circumvention of cache-disable configurations, memory consumption scales linearly or exponentially with the rate of unique requests. 5) Ultimately, the host exhausts available system memory, resulting in process termination by the operating system out-of-memory (OOM) killer or general application unresponsiveness.\nThe affected components are Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2. The vulnerability manifests via network exposure to the Connect authorization endpoint. The payload behavior centers on resource exhaustion through state accumulation in volatile memory. Post-exploitation impact is limited to denial-of-service via resource starvation, as arbitrary code execution or privilege escalation vectors are not described by this flaw."
}