CVE-2026-19014: 
Grafana vulnerability analysis and mitigation

CVE-2026-19014 is an uncontrolled resource consumption vulnerability in HashiCorp Consul's Connect authorization endpoint that allows an authenticated attacker to grow the agent's intention-match cache without bound, defeating operator-configured cache-disable settings. It affects Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2. The vulnerability was published on August 7, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, HashiCorp Forum).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the Connect authorization endpoint does not enforce any bound on the size of the intention-match cache maintained by the Consul agent, even when an operator has explicitly disabled caching via configuration. An authenticated caller with low privileges can repeatedly invoke this endpoint with crafted requests to continuously populate the cache, causing unbounded memory growth. No public proof-of-concept code has been identified at this time (GitHub Advisory, HashiCorp Forum).

Successful exploitation results in a denial-of-service condition: the Consul agent's memory is progressively exhausted by unbounded cache growth, degrading or disrupting service availability for all workloads relying on Consul for service mesh authorization. There is no confidentiality or integrity impact — the vulnerability is limited to availability (Low per CVSS). In environments where Consul is central to service discovery and mTLS authorization, disruption of the agent could affect downstream service-to-service communication across the infrastructure (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the time of publication. The EPSS score is approximately 0.262% (18th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with low privileges, reducing the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, HashiCorp Forum).

HashiCorp has released patched versions addressing this vulnerability: Consul Community Edition 2.0.3, and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. Operators should upgrade to one of these versions as the primary remediation. As a network-level workaround, restrict access to the Consul Connect authorization endpoint to trusted services only using firewall rules or network policies. Additionally, monitor Consul agent memory and cache consumption metrics to detect anomalous growth indicative of exploitation attempts (HashiCorp Forum, GitHub Advisory).