How severe is CVE-2026-15970?

CVE-2026-15970 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-15970 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-15970?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-15970 published?

CVE-2026-15970 was published on 2026-08-07 and last updated on 2026-08-10.

CVE-2026-15970

CVE-2026-15970 is a medium-severity vulnerability with a CVSS 3.x base score of 4.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-647.

Key facts

Severity: Medium (CVSS 3.x base score 4.2)
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-647
Published: 2026-08-07
Last modified: 2026-08-10

Description

Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Frequently asked questions

What is CVE-2026-15970?: Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
How severe is CVE-2026-15970?: CVE-2026-15970 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-15970 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-15970?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-15970 published?: CVE-2026-15970 was published on 2026-08-07 and last updated on 2026-08-10.

References

https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629

Other CWE-647 vulnerabilities

CVE-2022-43939 — High (CVSS 8.6): Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security…
CVE-2026-59731 — High (CVSS 8.2): Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially…
CVE-2026-62685 — High (CVSS 8.1): File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a…
CVE-2025-64500 — High (CVSS 7.3): Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's…
CVE-2025-9909 — Medium (CVSS 6.7): A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows…
CVE-2026-5222 — Medium (CVSS 6.5): Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol.…

Browse all CWE-647 vulnerabilities →