Description

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-07T20:16:50.530Z",
  "pubdate": "2026-08-07T20:16:50.530Z",
  "executiveSummary": "An access control list (ACL) enforcement vulnerability, tracked as CVE-2026-19016, exists within Consul Community Edition and Consul Enterprise. The flaw stems from the transaction API failing to enforce the required session:write ACL permission when processing session deletion operations. This authorization bypass allows an authenticated caller with network access to the Consul server RPC port to delete arbitrary sessions without holding the necessary administrative or write privileges.\nThe impact of this vulnerability includes unauthorized termination of active sessions, leading to potential service disruption, race conditions in distributed locking mechanisms, and degradation of cluster reliability. The risk implication is significant in multi-tenant or shared environments where strict tenant isolation depends on granular ACL enforcement. Exploitation requires network access to the Consul server RPC port and authentication, but circumvents explicit authorization checks designed to restrict session lifecycle management.\nAffected systems include Consul Community Edition and Consul Enterprise versions 1.19.1 through 2.0.2. Remediation requires upgrading to the patched releases provided by the vendor.",
  "technicalDetails": "The vulnerability resides in the transaction API component of Consul, which processes batched operations submitted by clients via the Consul server RPC port. Specifically, the root cause is a missing authorization check during session deletion operations routed through the transaction subsystem. While standard session deletion endpoints properly validate the session:write ACL permission, the transaction API fails to enforce this check before executing the deletion logic against the internal state store.\nThe vulnerable components comprise the transaction processing engine and the session management subsystem within Consul Community Edition and Consul Enterprise versions 1.19.1 through 2.0.2. Exploitation requires an authenticated caller with network access to the Consul server RPC port. Although the attacker must be authenticated, the vulnerability allows privilege escalation regarding session management capabilities, as standard users lacking session:write permissions can bypass authorization boundaries.\nThe attack flow proceeds as follows: First, the authenticated attacker establishes a network connection to the Consul server RPC port. Second, the attacker crafts a malicious transaction payload containing a session deletion operation targeting an arbitrary session ID. Third, the attacker submits the transaction request to the Consul server. Fourth, the transaction API processes the batch without verifying if the caller possesses the session:write permission. Finally, the targeted session is successfully deleted from the cluster state without authorization, potentially invalidating distributed locks or disrupting dependent services."
}