Path Traversal in Hashicorp Consul
CVE-2026-19016
Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.002 (11.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Hashicorp Consul — versions 1.19.1
- Hashicorp Consul Enterprise — versions 1.19.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-19016?
- CVE-2026-19016 is a medium-severity vulnerability in Hashicorp Consul, classified under Path Traversal. CVSS score: 4.2/10. Published 2026-08-07.
- How severe is CVE-2026-19016?
- Medium severity. CVSS v3 base score is 4.2 out of 10.