# CVE-2026-19016: Authorization bypass for session deletion in the transaction API

> CVE-2026-19016: Authorization bypass for session deletion in the transaction API. CVSS 4.2 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-19016
Last updated: 2026-08-28T15:47:00Z

- Published: 2026-08-07 19:18 UTC · Updated: 2026-08-28 15:47 UTC · Assigner: HashiCorp
- CVSS: 4.2 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
- EPSS: 0.27%, 20th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-22

## Description

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

## Affected vendors and products

- HashiCorp: Consul
- HashiCorp: Consul Enterprise

## Tracked companies

- [HashiCorp](https://rewindex.com/company/hashicorp.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-19016)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-19016)
- [https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629](https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-19016 · Markdown: https://rewindex.com/cve/CVE-2026-19016.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-19016 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:12.401Z