Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-105765

Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Consul

Default version status: unaffected

  • 1.17.0 to < 2.1.0affected

HashiCorp Consul Enterprise

Default version status: unaffected

  • 1.17.0 to < 2.1.0affected

References