CVE-2026-105626

🚨 HashiCorp Consul: 4 new CVEs. One lets a caller with no ACL token pull a service's cached mesh certificate and its private key from the agent 🆔 CVE-2026-105608 · CVSS 3.1 8.8 (CNA): service:write without mesh:write can inject raw Envoy config into a sidecar (Consul 2.0.4; Enterprise 2.0.4, 1.22.12, 1.21.18) 🆔 CVE-2026-105765 · 7.5: cached leaf cert + private key returned without an ACL check (1.17.0 up to 2.0.4) 🆔 CVE-2026-105626 · 7.5: unauthenticated memory-exhaustion DoS via the HTTP API (up to 2.0.4) 🆔 CVE-2026-115804 · 6.4: rebind another service's health check on the same node (0.7.2 up to 2.0.4) ✅ Fixed: Consul 2.1.0 · Consul Enterprise 2.1.0 / 1.21.19 (HashiCorp bulletins, Oct 26, 2026) ⚠️ Patch now if ACLs are enabled and the agent HTTP API is reachable beyond loopback. Otherwise, next maintenance window. Not in CISA KEV. 🛡️ Quick check: run `consul version` and confirm `addresses.http` stays on 127.0.0.1 (the default). After upgrading, most HTTP API write endpoints reject bodies over 512 KiB. 🔗 https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911 #HashiCorp #Consul #CVE

⚠️ Daily CVE Roundup - October 27, 2026 Here are the notable CVEs disclosed or updated today: 🔴 Critical & High Severity · CVE-2026-111497 (Google Brotli / Node.js / Bun) - CVSS 7.3 (High). Buffer overflow in the Brotli decoder (c/dec/decode.c) allows remote unauthenticated attackers to corrupt memory, disclose sensitive data, cause denial of service, or potentially execute arbitrary code via a crafted Brotli-compressed stream. Affects Brotli versions 1.0.3 through 1.2.0, impacting Node.js, Bun, and Python Brotli packages (widely tracked as "Node2Shell" / "HTTP2Shell"). Fixed in Brotli 1.0.10, 1.1.1, and 1.2.1; Node.js 22.23.4, 24.22.1, and 26.12.1 . · CVE-2026-114625 (Arista VeloCloud Orchestrator) - CVSS 9.9 (Critical). SQL injection in on-premises VCO allows any authenticated user, including the lowest "Enterprise Read Only" role, to escalate to operator privileges and masquerade as a local superuser. Arista confirms the flaw is actively exploited in the wild. Fixed in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12 . · CVE-2026-110264 (GitLab CE/EE) - CVSS 10.0 (Critical). Integer overflow in the regex compiler allows an unauthenticated attacker to execute arbitrary code on self-managed GitLab servers. Affects versions from 7.0 before 18.11.13, 19.0 before 19.0.10, and subsequent 19.x branches. Fixed in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1 . 🟡 Medium & Notable · CVE-2026-110447 (Collabora Online Built-in CODE Server) - Critical severity. OS command injection in proxy.php when the CODE server isn't running allows remote code execution. Affects the Nextcloud app richdocumentscode before version 26.4.303; not present in standalone Collabora Online servers. Actively exploited in the wild in September and October 2026 . · CVE-2026-105626 (HashiCorp Consul / Consul Enterprise) - CVSS 7.5 (High). Denial of service in the HTTP API may allow an unauthenticated attacker to exhaust memory on a Consul agent. Fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 / 1.21.19 . 📢 Join our Telegram channel for daily CVE updates and cybersecurity news: https://t.me/bugbountyusa #CVE #CyberSecurity #VulnerabilityManagement #InfoSec #PatchManagement #ThreatIntelligence #SecurityAdvisory #BugBounty #DailyCVE #CyberNews