CVE-2026-15970 L7 intention authorization bypass via custom public listener
Authenticated mesh workloads can bypass L7 intention authorization to access blocked HTTP paths when custom public listeners are configured.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15970?
CVE-2026-15970 is a medium-severity authentication bypass vulnerability in HashiCorp Consul, published on 7 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Weakness: CWE-647
Which versions are affected by CVE-2026-15970?
1 open source package ship an affected version, including consul.
| Package | Affected | Fixed in |
|---|---|---|
consul Bitnami | From 1.20.1 | 2.0.3 |
How do I fix CVE-2026-15970?
Upgrade consul to 2.0.3 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-15970 being exploited?
There is no known exploitation of CVE-2026-15970 in the wild and no public exploit code.
Sources
Also known as BIT-consul-2026-15970, DEBIAN-CVE-2026-15970, GHSA-h928-jqxm-5f3x, MINI-77jc-fx9r-f9j5, MINI-hvr8-xwjg-c86p, UBUNTU-CVE-2026-15970.