HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration.
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- HashiCorp
- Product
- Consul, Consul Enterprise
- CVSS v3.1
- 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Fix
- available
- Weakness
- CWE-178
- Exposure class
- Developer platform
- NVD status
- Awaiting Analysis
Why it ranks 22 (Routine)
- CVSS v3.1 8.8 high
- Product class: developer platform
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.