Steeltoe Consul Discovery CVE-2026-81516

Requires the attacker to be able to register a service in the Consul catalog used by the target - i.e. Consul catalog write access via a valid ACL token, or a Consul deployment running without ACLs. The application must use Steeltoe ConsulDiscoveryClient in an affected version (4.0.0 through 4.2.x). The attacker registers a service whose 'secure' metadata contains any string other than 'true'/'false' (e.g. 'yes', '1', ''); the malformed value throws during ConsulServiceInstance construction and aborts GetAllInstancesAsync. Limiting factors: exploitation is gated on Consul registration privilege (no anonymous internet path unless Consul is exposed and ACL-less), no user interaction is needed, and the outage persists only until the offending registration is removed - no permanent state corruption.

This is a genuine but bounded availability issue, not a high-CVSS paper tiger and not a top-tier emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) captures a pure denial-of-service: a malformed Consul 'secure' metadata value ('yes', '1', empty, etc.) triggers an unhandled exception in bool.Parse that aborts construction of the entire instance list, making one or all services undiscoverable. The commit diff (bool.Parse → bool.TryParse) independently confirms the root cause (CWE-755 unhandled exception), so the technical claim is solid. The key point of contention is PR:N: the description explicitly requires 'a principal that can register a Consul service,' meaning the attacker must already hold Consul catalog write access (an ACL token, or an ACL-less/open Consul). That is a real privilege prerequisite, so I assess PR:L rather than PR:N, lowering my score to ~6.5. There is no EPSS score, no CISA KEV listing, and no public POC provided - no public exploit identified at time of analysis. Impact is confidentiality/integrity neutral (C:N/I:N); the worst case is a persistent service-discovery outage until the offending registration is removed. Net: a legitimate priority for teams running Steeltoe Consul discovery with shared/multi-tenant Consul, but low urgency where Consul registration is tightly controlled.

An insider or compromised workload that can register services in the shared Consul catalog registers a service whose 'secure' metadata is a non-boolean string such as 'yes'. When a Steeltoe (4.0.0-4.2.x) application calls GetAllInstancesAsync, bool.Parse throws and aborts enumeration, knocking every service out of discovery until the bad registration is deleted. No public exploit code was provided, but the trigger is trivial and reliably reproducible.