CVE-2026-105608

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://discuss.hashicorp.com/t/hcsec-2026-47-consul-vulnerable-to-an-authorization-bypass-in-service-mesh-registration/77912

Weakness type (CWE)

CWE-178

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911

Full discourse1 post

Eliran Emuna@EmunaEliran18h
🚨 HashiCorp Consul: 4 new CVEs. One lets a caller with no ACL token pull a service's cached mesh certificate and its private key from the agent 🆔 CVE-2026-105608 · CVSS 3.1 8.8 (CNA): service:write without mesh:write can inject raw Envoy config into a sidecar (Consul 2.0.4; Enterprise 2.0.4, 1.22.12, 1.21.18) 🆔 CVE-2026-105765 · 7.5: cached leaf cert + private key returned without an ACL check (1.17.0 up to 2.0.4) 🆔 CVE-2026-105626 · 7.5: unauthenticated memory-exhaustion DoS via the HTTP API (up to 2.0.4) 🆔 CVE-2026-115804 · 6.4: rebind another service's health check on the same node (0.7.2 up to 2.0.4) ✅ Fixed: Consul 2.1.0 · Consul Enterprise 2.1.0 / 1.21.19 (HashiCorp bulletins, Oct 26, 2026) ⚠️ Patch now if ACLs are enabled and the agent HTTP API is reachable beyond loopback. Otherwise, next maintenance window. Not in CISA KEV. 🛡️ Quick check: run `consul version` and confirm `addresses.http` stays on 127.0.0.1 (the default). After upgrading, most HTTP API write endpoints reject bodies over 512 KiB. 🔗 https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911 #HashiCorp #Consul #CVE
1001041
74 followersView on X

Explore more

Back to dashboard