CVE-2026-19016: Authorization bypass for session deletion in the transaction API
Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Consul Community Editionto a version that resolves this vulnerability.Fixed in 2.0.3 - Upgrade
Upgrade
Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.21.17 - Upgrade
Upgrade
Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.22.11 - Upgrade
Upgrade
Consul Enterpriseto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19016?
CVE-2026-19016 has a medium severity rating of 4.2.
How do I fix CVE-2026-19016?
To mitigate CVE-2026-19016, ensure that the {{session:write}} ACL permission is properly enforced for session deletion operations.
What type of applications are affected by CVE-2026-19016?
CVE-2026-19016 affects HashiCorp Consul Community Edition and Consul Enterprise versions 1.19.1 through 2.0.2.
What vulnerability type is represented by CVE-2026-19016?
CVE-2026-19016 represents an Authorization bypass vulnerability in the transaction API.
Can an unauthorized user exploit CVE-2026-19016?
An authenticated user with network access to the Consul server RPC port can exploit CVE-2026-19016 to delete arbitrary sessions.