Vulnerabilities

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API…

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

HashiCorp

Product

Consul, Consul Enterprise

CVSS v3.1

7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix

available

Weakness

CWE-862

Exposure class

Developer platform

NVD status

Awaiting Analysis

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-105765 on this site · NVD · CVE.org · Vulnpedia