CE
Product
Consul Enterprise
by HashiCorp · last CVE Oct 26, 2026
19
CVEs
0
On KEV
8.8
Max CVSS
4
New 30D
Severity mix
Critical 0High 6Medium 13Low 0
Watch

Add Consul Enterprise to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-19017
6.8
0%
Aug 7
Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
Affected: 1.18.21 before 2.0.3
CVE-2026-2808
6.8
0%
Mar 11
Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider
Affected: before 1.22.5
CVE-2026-87106
6.5
0%
Sep 10
Consul vulnerable to a denial of service in the native RPC listener
Affected: 1.21.0 before 2.0.4
CVE-2025-11374
6.5
0%
Oct 28
Consul's KV endpoint is vulnerable to denial of service
Affected: before 1.22.0
CVE-2025-11375
6.5
0%
Oct 28
Consul's event endpoint is vulnerable to denial of service
Affected: before 1.22.0
CVE-2026-115804
New
6.4
0%
Oct 26
Consul vulnerable to an authorization bypass in health check registration
Affected: 0.7.2 before 2.1.0
CVE-2026-87107
5.4
0%
Sep 10
Consul vulnerable to an authorization bypass in the catalog deregistration path
Affected: 1.21.0 before 2.0.4
CVE-2026-19113
5.3
0%
Aug 7
Unauthenticated denial of service via unbounded request body processing
Affected: 1.3.0 before 2.0.3
CVE-2026-19015
5.3
0%
Aug 7
Uncontrolled resource consumption in the Consul Connect CA roots endpoint
Affected: 1.2.0 before 2.0.3
CVE-2026-19012
5.3
0%
Aug 7
Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path
Affected: 1.18.0 before 2.0.3
CVE-2026-19014
4.3
0%
Aug 7
Uncontrolled resource consumption in the Consul Connect authorization endpoint
Affected: 1.17.0 before 2.0.3
CVE-2026-15970
4.2
0%
Aug 7
L7 intention authorization bypass via custom public listener
Affected: 1.20.1 before 2.0.3
CVE-2026-19016
4.2
0%
Aug 7
Authorization bypass for session deletion in the transaction API
Affected: 1.19.1 before 2.0.3
Showing 13