HCSEC-2026-34 - Consul vulnerable to an authorization bypass in the catalog node-write path

Published September 10, 2026 CVE-2026-87090

HashiCorp Consul had a flaw that let someone with limited write access to their own server entry delete a different server's registration and take over its identity instead. This only affects Consul clusters that use access control lists with narrow, per-server permissions.

Severity
HighCVSS 3.1 · 8.3
Fix
Fixed in 1.21.18Fix recorded today
Affected versions
0.1.0 to before 2.0.4; 0.1.0 to before 2.0.4
Weakness
CWE-863Incorrect Authorization
Exploit likelihood
0.21% in 30 daysEPSS, higher than 11% of known flaws
Affects
Consul+1 more
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: partial
EU ID
EUVD-2026-75679ENISA vulnerability database

How it works

  • Consul lets an operator register a server, known as a node, through its catalog registration feature, and access to that feature is controlled by ACL permissions tied to specific node names.
  • That feature is supposed to check that a registration request only touches the node names the requester is allowed to control.
  • It did not fully make that check, so a crafted registration request could affect a different node than the one the requester actually had permission over.
  • To do this, the attacker needs a valid ACL token with write permission on at least one node name, plus the ID of a target node they do not control.
  • If both conditions are met, the target node's registration, along with its listed services and health checks, can be deleted and effectively taken over.

What to do

Check your Consul version: this affects Consul up to 2.0.3, so compare your installed version against that cutoff. If you run Consul Enterprise, check whether you are on a release before 1.21.18 or 1.22.12, since those branches are also fixed. Confirm whether your deployment uses ACLs at all and whether any token is scoped to node-write on just one node name, since clusters without ACLs, or where every operator already has unrestricted node-write access, are not affected.

Upgrade to Consul 2.0.4 if you run standard Consul. Upgrade Consul Enterprise to 1.21.18, 1.22.12, or 2.0.4 depending on your current release branch. Review the HashiCorp advisory for the exact fixed build that matches your branch before upgrading.

Technical details

Affected software: Consulby HashiCorp, Consul Enterpriseby HashiCorp

The bug (CWE-863, incorrect authorization) sits in Consul's PUT /v1/catalog/register endpoint. ACL policies are meant to scope node:write permission to specific node names, but the endpoint did not fully verify that a registration request's effects stayed within the caller's permitted node scope. A token holder with node:write on one node name, who also knows another node's stable node ID, could submit a registration that overwrote that other node's catalog entry, deleting its services and health checks.

CVSS 3.1 base score is 8.3 (High). Fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact Low Some data can be read
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H Open in FIRST.org calculator

References

View Original Source