CVE-2026-15970

The record

Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Affected packages

Related vulnerabilities

• CVE-2026-80515 In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that… CWE-647
• CVE-2026-8384 In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an… CWE-647
• CVE-2026-59731 Astro is a web framework for content-driven websites. CWE-647
• CVE-2026-5222 Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries… CWE-647
• CVE-2025-9909 A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation… CWE-647
• CVE-2025-66202 Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CWE-647
• GHSA-whqg-ppgf-wp8c Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CWE-647
• CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass CWE-647