CVE catalog
CVE-2026-19016
UBUNTU-CVE-2026-19016
- Severity
- Medium · CVSS 4.2
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.27% · Oct 27, 2026
Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | consul | 11 | 1.10.12+dfsg1-1 | vulnerable |
| Debian | consul | 11 | 1.8.7+dfsg1-2 | vulnerable |
| Debian | consul | 11 | 1.8.7+dfsg1-3 | vulnerable |
| Debian | consul | 11 | 1.8.7+dfsg1-4 | vulnerable |
| Debian | consul | 11 | 1.8.7+dfsg1-5 | vulnerable |
| Debian | consul | 11 | 1.8.7+dfsg1-6 | vulnerable |
| Debian | consul | 11 | 1.9.17+dfsg2-1 | vulnerable |
| Ubuntu | consul | 18.04 | 0.6.4~dfsg-3 | vulnerable |
| Ubuntu | consul | 20.04 | 1.0.7~dfsg1-5ubuntu1 | vulnerable |
| Ubuntu | consul | 20.04 | 1.4.4~dfsg1-2ubuntu2 | vulnerable |
| Ubuntu | consul | 20.04 | 1.5.2+dfsg1-6 | vulnerable |
| Ubuntu | consul | 20.04 | 1.5.2+dfsg1-10 | vulnerable |
| Ubuntu | consul | 20.04 | 1.5.2+dfsg1-12 | vulnerable |
| Ubuntu | consul | 20.04 | 1.5.2+dfsg2-14 | vulnerable |
| Ubuntu | consul | 22.04 | 1.7.4+dfsg1-1 | vulnerable |
| Ubuntu | consul | 22.04 | 1.8.7+dfsg1-3 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: