CVE-2026-19016 — Authorization bypass for session deletion in the transaction API

Description (CNA)

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Consul	affected 1.19.1 before 2.0.3
HashiCorp / Consul Enterprise	affected 1.19.1 before 2.0.3

CWE

CWE-22

References

https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.