CVE-2026-15972
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections.
Risk Assessment
The attack can prevent legitimate clients from connecting, causing service disruption.
Recommendation
Upgrade Consul to version 2.0.3 (or appropriate Enterprise version) that includes the fix.
Other vulnerabilities in Consul
See all- CVE-2026-19113Medium
Consul Community Edition and Consul Enterprise versions 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This is fixed in Consul 2.0.3 and corresponding Enterprise versions.
- CVE-2026-19017Medium
Consul Community Edition and Consul Enterprise versions 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to exfiltration of sensitive secrets from the Consul server host.
- CVE-2026-19016Medium
Consul Community Edition and Consul Enterprise versions 1.19.1 through 2.0.2 did not enforce the `session:write` ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission.
- CVE-2026-19015Medium
Consul Community Edition and Consul Enterprise versions 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration.
- CVE-2026-19014Medium
A vulnerability in Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2 causes uncontrolled resource consumption in the Connect authorization endpoint. This allows an attacker to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- CVE-2026-19012Medium
A vulnerability in Consul Community Edition and Consul Enterprise versions 1.18.0 through 2.0.2 allows an authenticated attacker to crash the Consul server during the Enterprise-to-Community downgrade path. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- CVE-2026-15970Medium
A vulnerability in Consul Community Edition and Consul Enterprise versions 1.20.1 through 2.0.2 allows an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Original NVD description (English source)
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.