Product by HashiCorp
Consul Enterprise
27 known vulnerabilities in Consul Enterprise (HashiCorp), 0 of them actively exploited (CISA KEV).
Key figures
27
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-105608 | Consul vulnerable to an authorization bypass in service mesh registration | 8.8 | |
| High | CVE-2026-105626 | Consul vulnerable to a denial of service in HTTP APIs | 7.5 | |
| High | CVE-2026-15972 | Unauthenticated denial of service via unbounded external gRPC connection acceptance | 7.5 | |
| High | CVE-2026-87090 | Consul vulnerable to an authorization bypass in the catalog node-write path | 8.3 | |
| High | CVE-2024-10005 | Consul L7 Intentions Vulnerable To URL Path Bypass | 8.1 | |
| High | CVE-2026-105765 | Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API | 7.5 | |
| Medium | CVE-2026-19017 | Consul vulnerable to partial arbitrary file read via Vault Connect CA provider | 6.8 | |
| High | CVE-2026-88021 | Consul vulnerable to an authorization bypass in the Connect service mesh | 7.5 | |
| Medium | CVE-2026-87106 | Consul vulnerable to a denial of service in the native RPC listener | 6.5 | |
| Medium | CVE-2026-115804 | Consul vulnerable to an authorization bypass in health check registration | 6.4 | |
| Medium | CVE-2026-2808 | Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider | 6.8 | |
| High | CVE-2023-2816 | Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner | 8.7 | |
| High | CVE-2024-10006 | Consul L7 Intentions Vulnerable To Headers Bypass | 8.3 | |
| Medium | CVE-2023-0845 | Consul Server Panic when Ingress and API Gateways Configured with Peering | 4.9 | |
| Medium | CVE-2026-19113 | Unauthenticated denial of service via unbounded request body processing | 5.3 | |
| Medium | CVE-2026-19015 | Uncontrolled resource consumption in the Consul Connect CA roots endpoint | 5.3 | |
| Medium | CVE-2026-87107 | Consul vulnerable to an authorization bypass in the catalog deregistration path | 5.4 | |
| Medium | CVE-2025-11374 | Consul's KV endpoint is vulnerable to denial of service | 6.5 | |
| Medium | CVE-2025-11375 | Consul's event endpoint is vulnerable to denial of service | 6.5 | |
| Medium | CVE-2026-19012 | Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path | 5.3 | |
| High | CVE-2023-3518 | JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access | 7.4 | |
| High | CVE-2023-1297 | Consul Cluster Peering can Result in Denial of Service | 4.9 | |
| High | CVE-2022-3920 | Consul Peering Imported Nodes/Services Leak | 5.3 | |
| Medium | CVE-2026-19014 | Uncontrolled resource consumption in the Consul Connect authorization endpoint | 4.3 | |
| Medium | CVE-2024-10086 | Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation | 6.1 |