CVE-2026-19016
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Consul Community Edition and Consul Enterprise versions 1.19.1 through 2.0.2 did not enforce the `session:write` ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission.
Risk Assessment
An attacker could delete sessions of other users, potentially leading to service disruption or data integrity issues.
Recommendation
Upgrade Consul to version 2.0.3 (Community) or the appropriate Enterprise version (1.21.17, 1.22.11, 2.0.3).
Original NVD description (English source)
Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.