CVE-2026-15970
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A vulnerability in Consul Community Edition and Consul Enterprise versions 1.20.1 through 2.0.2 allows an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Risk Assessment
The risk is unauthorized access to protected resources in the mesh environment, potentially violating security policies and leading to data exposure.
Recommendation
Upgrade Consul to version 2.0.3 or later (for Enterprise to the specified versions) and review proxy listener configurations.
Original NVD description (English source)
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.