UBUNTU-CVE-2026-105765: High severity ubuntu/consul vulnerability

Published Oct 26, 2026

Updated

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

Affected Software

3 affected components

ubuntu/consul*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HashiCorp Consul Community Edition to a version that resolves this vulnerability.
Fixed in 2.1.0
Upgrade
Upgrade HashiCorp Consul Enterprise to a version that resolves this vulnerability.
Fixed in 2.1.0
Upgrade
Upgrade HashiCorp Consul Enterprise to a version that resolves this vulnerability.
Fixed in 1.21.19

Event History

Oct 26, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Consul releases contain fixes for this issue?

The issue is fixed in Consul Community Edition 2.1.0. For Consul Enterprise, it is fixed in versions 2.1.0 and 1.21.19.

What access does an attacker need to exploit the vulnerable API?

The vulnerability may be exploited by an attacker without a valid ACL token. The affected agent service mesh leaf certificate API can disclose a cached service leaf certificate and its private key.

UBUNTU-CVE-2026-105765: High severity ubuntu/consul vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Consul releases contain fixes for this issue?

What access does an attacker need to exploit the vulnerable API?

Company

Resources

Contact

Frequently Asked Questions

Which Consul releases contain fixes for this issue?

What access does an attacker need to exploit the vulnerable API?