CVE-2026-19014: Uncontrolled resource consumption in the Consul Connect authorization endpoint
Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Consulto a version that resolves this vulnerability.Fixed in 2.0.3Patch CVE-2026-190124 - Upgrade
Upgrade
Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.21.17Patch CVE-2026-190124 - Upgrade
Upgrade
Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.22.11Patch CVE-2026-190124 - Upgrade
Upgrade
Consul Enterpriseto a version that resolves this vulnerability.Fixed in 2.0.3Patch CVE-2026-190124
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19014?
The severity of CVE-2026-19014 is medium, with a CVSS score of 4.3.
How do I fix CVE-2026-19014?
To fix CVE-2026-19014, upgrade your HashiCorp Consul Community Edition or Consul Enterprise to version 2.0.3 or above.
What software is affected by CVE-2026-19014?
CVE-2026-19014 affects HashiCorp Consul Community Edition and HashiCorp Consul Enterprise versions 1.17.0 through 2.0.2.
What is the impact of CVE-2026-19014?
CVE-2026-19014 can lead to uncontrolled resource consumption, allowing a caller to grow the agent's intention-match cache excessively.
Is there a workaround for CVE-2026-19014 if I cannot upgrade?
As of now, there is no specific workaround for CVE-2026-19014 other than applying the recommended upgrade.