What’s Vulnerable › Products
HashiCorp Consul Enterprise vulnerabilities
17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.
Check whether your HashiCorp Consul Enterprise version is affected
Latest HashiCorp Consul Enterprise vulnerabilities
- CVE-2026-115804 — Consul vulnerable to an authorization bypass in health check registration (CVSS 6.4)
- CVE-2026-105626 — Consul vulnerable to a denial of service in HTTP APIs (CVSS 7.5)
- CVE-2026-105608 — Consul vulnerable to an authorization bypass in service mesh registration (CVSS 8.8)
- CVE-2026-105765 — Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API (CVSS 7.5)
- CVE-2026-88021 — Consul vulnerable to an authorization bypass in the Connect service mesh (CVSS 7.1)
- CVE-2026-87107 — Consul vulnerable to an authorization bypass in the catalog deregistration path (CVSS 5.4)
- CVE-2026-87106 — Consul vulnerable to a denial of service in the native RPC listener (CVSS 6.5)
- CVE-2026-87090 — Consul vulnerable to an authorization bypass in the catalog node-write path (CVSS 8.3)
- CVE-2026-19113 — Unauthenticated denial of service via unbounded request body processing (CVSS 5.3)
- CVE-2026-19017 — Consul vulnerable to partial arbitrary file read via Vault Connect CA provider (CVSS 6.8)
- CVE-2026-19016 — Authorization bypass for session deletion in the transaction API (CVSS 4.2)
- CVE-2026-19015 — Uncontrolled resource consumption in the Consul Connect CA roots endpoint (CVSS 5.3)
- CVE-2026-19014 — Uncontrolled resource consumption in the Consul Connect authorization endpoint (CVSS 4.3)
- CVE-2026-19012 — Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path (CVSS 5.3)
- CVE-2026-15972 — Unauthenticated denial of service via unbounded external gRPC connection acceptance (CVSS 7.5)
- CVE-2026-15970 — L7 intention authorization bypass via custom public listener (CVSS 4.2)
- CVE-2026-2808 — Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider (CVSS 6.8)