Skip to content
Heist/ feed
Back to feed
UnratedFix available

HCSEC-2026-25 - Multiple vulnerabilities impacting HashiCorp Consul

Type: patchSources: HashiCorp discuss security

HashiCorp Consul Community Edition and Enterprise are affected by eight vulnerabilities, including denial of service, resource consumption, authorization bypass, and file-read issues. The bulletin says the listed releases fix the vulnerabilities.

Products
Consul Community Edition, Consul Enterprise
Affected versions
1.13.0 through 2.0.2, 1.17.0 through 2.0.2, 1.18.0 through 2.0.2, 1.18.21 through 2.0.2, 1.19.1 through 2.0.2, 1.2.0 through 2.0.2, 1.20.1 through 2.0.2, 1.3.0 through 2.0.2
Fixed versions
1.21.17, 1.22.11, 2.0.3
CVEs
CVE-2026-15970, CVE-2026-15972, CVE-2026-19012, CVE-2026-19014, CVE-2026-19015, CVE-2026-19016, CVE-2026-19017, CVE-2026-19113
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 18:52 UTC · Revision 1

Source evidence

HCSEC-2026-25 - Multiple vulnerabilities impacting HashiCorp Consul

official-hashicorp-discuss-security · Original source

Published 7 Aug 2026, 19:01 UTC

HashiCorp Consul Community Edition and Enterprise are affected by eight vulnerabilities, including denial of service, resource consumption, authorization bypass, and file-read issues. The bulletin says the listed releases fix the vulnerabilities.

All vulnerabilities are fixed in Consul Community Edition 2.0.3 and Consul Enterprise 2.0.3, 1.22.11, and 1.21.17.

Consul Community Edition

Fixed versions: 2.0.3

Consul Enterprise

Fixed versions: 2.0.3, 1.22.11, 1.21.17

Complete source record
{
  "id": "0fba544135f1ebab15854f221d801bc913e28bb511e37bbae6fb89f0c971563e",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-25 - Multiple vulnerabilities impacting HashiCorp Consul",
    "summary": "HashiCorp Consul Community Edition and Enterprise are affected by eight vulnerabilities, including denial of service, resource consumption, authorization bypass, and file-read issues. The bulletin says the listed releases fix the vulnerabilities.",
    "evidence": "All vulnerabilities are fixed in Consul Community Edition 2.0.3 and Consul Enterprise 2.0.3, 1.22.11, and 1.21.17.",
    "products": [
      {
        "name": {
          "value": "Consul Community Edition",
          "evidence": "Consul Community Edition 2.0.3"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.0.3",
            "evidence": "All vulnerabilities are fixed in Consul Community Edition 2.0.3 and Consul Enterprise 2.0.3, 1.22.11, and 1.21.17."
          }
        ],
        "affected_versions": [
          {
            "value": "1.18.0 through 2.0.2",
            "evidence": "CVE-2026-19012: Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2."
          },
          {
            "value": "1.17.0 through 2.0.2",
            "evidence": "CVE-2026-19014: Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2."
          },
          {
            "value": "1.2.0 through 2.0.2",
            "evidence": "CVE-2026-19015: Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2."
          },
          {
            "value": "1.18.21 through 2.0.2",
            "evidence": "CVE-2026-19017: Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2."
          },
          {
            "value": "1.19.1 through 2.0.2",
            "evidence": "CVE-2026-19016: Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2."
          },
          {
            "value": "1.20.1 through 2.0.2",
            "evidence": "CVE-2026-15970: Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2."
          },
          {
            "value": "1.13.0 through 2.0.2",
            "evidence": "CVE-2026-15972: Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2."
          },
          {
            "value": "1.3.0 through 2.0.2",
            "evidence": "CVE-2026-19113: Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2."
          }
        ]
      },
      {
        "name": {
          "value": "Consul Enterprise",
          "evidence": "Consul Enterprise 2.0.3, 1.22.11, and 1.21.17"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.0.3",
            "evidence": "All vulnerabilities are fixed in Consul Community Edition 2.0.3 and Consul Enterprise 2.0.3, 1.22.11, and 1.21.17."
          },
          {
            "value": "1.22.11",
            "evidence": "All vulnerabilities are fixed in Consul Community Edition 2.0.3 and Consul Enterprise 2.0.3, 1.22.11, and 1.21.17."
          },
          {
            "value": "1.21.17",
            "evidence": "All vulnerabilities are fixed in Consul Community Edition 2.0.3 and Consul Enterprise 2.0.3, 1.22.11, and 1.21.17."
          }
        ],
        "affected_versions": [
          {
            "value": "1.18.0 through 2.0.2",
            "evidence": "CVE-2026-19012: Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2."
          },
          {
            "value": "1.17.0 through 2.0.2",
            "evidence": "CVE-2026-19014: Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2."
          },
          {
            "value": "1.2.0 through 2.0.2",
            "evidence": "CVE-2026-19015: Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2."
          },
          {
            "value": "1.18.21 through 2.0.2",
            "evidence": "CVE-2026-19017: Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2."
          },
          {
            "value": "1.19.1 through 2.0.2",
            "evidence": "CVE-2026-19016: Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2."
          },
          {
            "value": "1.20.1 through 2.0.2",
            "evidence": "CVE-2026-15970: Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2."
          },
          {
            "value": "1.13.0 through 2.0.2",
            "evidence": "CVE-2026-15972: Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2."
          },
          {
            "value": "1.3.0 through 2.0.2",
            "evidence": "CVE-2026-19113: Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-19012",
        "evidence": "CVE-2026-19012: Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2."
      },
      {
        "value": "CVE-2026-19014",
        "evidence": "CVE-2026-19014: Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2."
      },
      {
        "value": "CVE-2026-19015",
        "evidence": "CVE-2026-19015: Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2."
      },
      {
        "value": "CVE-2026-19017",
        "evidence": "CVE-2026-19017: Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2."
      },
      {
        "value": "CVE-2026-19016",
        "evidence": "CVE-2026-19016: Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2."
      },
      {
        "value": "CVE-2026-15970",
        "evidence": "CVE-2026-15970: Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2."
      },
      {
        "value": "CVE-2026-15972",
        "evidence": "CVE-2026-15972: Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2."
      },
      {
        "value": "CVE-2026-19113",
        "evidence": "CVE-2026-19113: Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24017,
  "published_at": "2026-08-07T19:01:38+00:00"
}