HCSEC-2026-36 - Consul vulnerable to an authorization bypass in the catalog deregistration path

Published September 10, 2026 CVE-2026-87107

A Consul flaw lets an authorized local user remove services, health checks, or nodes imported from another connected cluster. That can disrupt service discovery and routing.

Severity
MediumCVSS 3.1 · 5.4
Fix
Fixed in 1.21.18Fix recorded today
Affected versions
1.21.0 to before 2.0.4
Weakness
CWE-863Incorrect Authorization
Exploit likelihood
0.23% in 30 daysEPSS, higher than 14% of known flaws
Affects
Consul+1 more
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: partial
EU ID
EUVD-2026-75699ENISA vulnerability database

How it works

  • The issue requires an active Consul cluster peering relationship and a local ACL token with catalog write access.
  • An attacker sends a crafted deregistration request for data imported from the other cluster.
  • Consul can remove those imported services, health checks, or nodes despite the token lacking authority over their original cluster.
  • The exporting cluster's authoritative data is not changed, and later replication may restore the entries.

What to do

Check the running Consul or Consul Enterprise version against the affected and fixed releases in HashiCorp's advisory. Confirm that the deployment uses cluster peering and that relevant local ACL tokens have service:write or node:write permission.

Upgrade Consul to 2.0.4. Upgrade Consul Enterprise to 1.21.18, 1.22.12, or 2.0.4.

Technical details

Affected software: Consulby HashiCorp, Consul Enterpriseby HashiCorp

CVE-2026-87107 crosses the ownership boundary between locally registered catalog objects and objects imported through cluster peering. Authorized local catalog writers can deregister peer-imported services, health checks, or nodes without authority over their original cluster.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact Low Some data can be modified
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Open in FIRST.org calculator

References

View Original Source