CVE-2026-15970

Name of the Vulnerable Software and Affected Versions Consul Community Edition versions 1.20.1 through 2.0.2 Consul Enterprise versions 1.20.1 through 2.0.2

Description An L7 intention authorization bypass exists when a service proxy is configured with a custom public listener. This allows an authenticated mesh workload to access HTTP paths that should be blocked by a path-based deny intention. L7 refers to the Application Layer of the OSI model, which handles high-level communication protocols like HTTP.

Recommendations Update Consul Community Edition to version 2.0.3. Update Consul Enterprise to versions 1.21.17, 1.22.11, or 2.0.3.