CVE-2026-105765: HCSEC-2026-46 - Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HashiCorp Consul Community Editionto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
HashiCorp Consul Enterpriseto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
HashiCorp Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.21.19
Event History
Frequently Asked Questions
Which deployments are affected?
HashiCorp Consul and Consul Enterprise versions 1.17.0 through 2.0.4 are affected. Fixed releases are Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
What could an unauthenticated attacker obtain?
An attacker without a valid ACL token may be able to retrieve a cached service mesh leaf certificate and its private key through the agent's service mesh leaf certificate API.
Does exploitation require valid Consul credentials or user interaction?
No valid ACL token is required according to the advisory. The supplied vector also indicates network exploitation with low complexity and no user interaction.