What’s Vulnerable › Products
HashiCorp Consul vulnerabilities
52 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 22 published in the last 12 months.
Check whether your HashiCorp Consul version is affected
Latest HashiCorp Consul vulnerabilities
- CVE-2026-115804 — Consul vulnerable to an authorization bypass in health check registration (CVSS 6.4)
- CVE-2026-105626 — Consul vulnerable to a denial of service in HTTP APIs (CVSS 7.5)
- CVE-2026-105608 — Consul vulnerable to an authorization bypass in service mesh registration (CVSS 8.8)
- CVE-2026-105765 — Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API (CVSS 7.5)
- CVE-2026-88021 — Consul vulnerable to an authorization bypass in the Connect service mesh (CVSS 7.1)
- CVE-2026-87107 — Consul vulnerable to an authorization bypass in the catalog deregistration path (CVSS 5.4)
- CVE-2026-87106 — Consul vulnerable to a denial of service in the native RPC listener (CVSS 6.5)
- CVE-2026-87090 — Consul vulnerable to an authorization bypass in the catalog node-write path (CVSS 8.3)
- CVE-2026-19113 — Unauthenticated denial of service via unbounded request body processing (CVSS 5.3)
- CVE-2026-19017 — Consul vulnerable to partial arbitrary file read via Vault Connect CA provider (CVSS 6.8)
- CVE-2026-19016 — Authorization bypass for session deletion in the transaction API (CVSS 4.2)
- CVE-2026-19015 — Uncontrolled resource consumption in the Consul Connect CA roots endpoint (CVSS 5.3)
- CVE-2026-19014 — Uncontrolled resource consumption in the Consul Connect authorization endpoint (CVSS 4.3)
- CVE-2026-19012 — Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path (CVSS 5.3)
- CVE-2026-15972 — Unauthenticated denial of service via unbounded external gRPC connection acceptance (CVSS 7.5)
- CVE-2026-15970 — L7 intention authorization bypass via custom public listener (CVSS 4.2)
- CVE-2026-2808 — Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider (CVSS 6.8)
- CVE-2025-11375 — Consul's event endpoint is vulnerable to denial of service (CVSS 6.5)
- CVE-2025-11374 — Consul's KV endpoint is vulnerable to denial of service (CVSS 6.5)
- CVE-2024-10086 — Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation (CVSS 6.1)
- CVE-2024-10006 — Consul L7 Intentions Vulnerable To Headers Bypass (CVSS 5.8)
- CVE-2024-10005 — Consul L7 Intentions Vulnerable To URL Path Bypass (CVSS 5.8)
- CVE-2023-5332 — Dependency on Vulnerable Third-Party Component in GitLab (CVSS 8.1)
- CVE-2023-3518 — JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access (CVSS 7.3)
- CVE-2023-2816 — Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner (CVSS 6.5)