🚨 HashiCorp Consul: 4 new CVEs. One lets a caller with no ACL token pull a service's cached mesh certificate and its private key from the agent 🆔 CVE-2026-105608 · CVSS 3.1 8.8 (CNA): service:write without mesh:write can inject raw Envoy config into a sidecar (Consul 2.0.4; Enterprise 2.0.4, 1.22.12, 1.21.18) 🆔 CVE-2026-105765 · 7.5: cached leaf cert + private key returned without an ACL check (1.17.0 up to 2.0.4) 🆔 CVE-2026-105626 · 7.5: unauthenticated memory-exhaustion DoS via the HTTP API (up to 2.0.4) 🆔 CVE-2026-115804 · 6.4: rebind another service's health check on the same node (0.7.2 up to 2.0.4) ✅ Fixed: Consul 2.1.0 · Consul Enterprise 2.1.0 / 1.21.19 (HashiCorp bulletins, Oct 26, 2026) ⚠️ Patch now if ACLs are enabled and the agent HTTP API is reachable beyond loopback. Otherwise, next maintenance window. Not in CISA KEV. 🛡️ Quick check: run `consul version` and confirm `addresses.http` stays on 127.0.0.1 (the default). After upgrading, most HTTP API write endpoints reject bodies over 512 KiB. 🔗 https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911 #HashiCorp #Consul #CVE