Vulnerabilities CVE-2026-15970

CVE-2026-15970

Medium

Open

TLP:CLEAR

L7 intention authorization bypass via custom public listener

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Details

CVSS Score: 4.2
EPSS Score ⓘ: 0.16%

5.6th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Confidence: 90%
Published: Aug 7, 2026
Last Modified: Aug 10, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.