HashiCorp Consul CVE-2026-105765

Exploitation requires network reachability to an affected Consul or Consul Enterprise agent's service mesh leaf certificate API, and critically the target service leaf certificate must ALREADY be present in that agent's cache - the flaw returns a cached certificate and its private key, so the attack is bounded to services actively using Consul service mesh (Connect) whose certificates have been cached by the agent. No valid ACL token is required (PR:N), which is precisely the authorization bypass, and no user interaction is needed. Limiting factors: the affected version range is Consul and Consul Enterprise 1.17.0 up to 2.0.4 (fixed in 2.1.0 / Enterprise 2.1.0 and 1.21.19); environments not using the service mesh feature, or where no relevant leaf certificate is cached, have no certificate for the attacker to retrieve. The precise request needed to trigger the cached-certificate retrieval is not described in the available source.

This is a genuine high-priority issue rather than a CVSS-inflated one, though not an emergency. The input vuln.today Decision label is 'this_week', which aligns with the signals: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact (C:H), and the impact - retrieval of a service leaf certificate AND its private key - is severe because a stolen mesh private key can be used to impersonate a service within the mesh. No EPSS score is provided in the input, so exploitation probability cannot be quantified. This CVE is NOT in CISA KEV and no proof-of-concept or exploit reference is present (only the vendor advisory), so there is no public exploit identified at time of analysis. The practical constraint that tempers raw severity is that the attacker can only retrieve a leaf certificate that is ALREADY cached by the target agent, so impact depends on mesh usage and cache state rather than being exploitable against an idle default install. No SSVC exploitation/automatable/technical-impact decision fields were supplied beyond the 'this_week' priority label, so the automatable and technical-impact dimensions are not independently confirmed.

An attacker with network access to a Consul agent's HTTP API, but without any valid ACL token, calls the service mesh leaf certificate endpoint and receives a cached service leaf certificate together with its private key. With that private key the attacker can impersonate the affected service inside the service mesh. No public exploit code or PoC is identified at time of analysis, and the low attack complexity (AC:L) with no required privileges or user interaction makes exploitation straightforward where a cached certificate exists.