CVE-2019-12291: Hashicorp Consul

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.

Affected products

• Hashicorp Consul: from 1.4.0, up to and including 1.5.0

Published 2019-06-06. Last modified 2026-06-17.