Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-105608

Consul vulnerable to an authorization bypass in service mesh registration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Consul

Default version status: unaffected

  • 2.0.4 to < 2.1.0affected

HashiCorp Consul Enterprise

Default version status: unaffected

  • 2.0.4 to < 2.1.0affected

References