HashiCorp Consul CVE-2026-87090

The attacker must be authenticated to the Consul cluster and hold an ACL token that grants node-write permission on at least one node name, which need not be the target node-any node-write grant is sufficient. The attacker must additionally obtain the node ID (UUID) of the node they wish to target; node IDs are distinct from node names but are typically accessible via catalog read APIs available to low-privileged tokens, making enumeration straightforward under default configurations. Exploitation is practically limited to environments where untrusted or semi-trusted principals are issued node-write tokens, such as multi-tenant clusters with delegated per-team ACL policies. Deployments where node-write tokens are issued exclusively to a small set of fully trusted operators, or where catalog read access is restricted by namespace or partition policy, significantly reduce exploitability beyond the raw CVSS score.

The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) is coherent with the described vulnerability: network-accessible, low attack complexity once the attacker holds any node-write token, requiring only low-level authentication. The high integrity and availability impacts reflect the ability to delete arbitrary node registrations and assume their identities, which can destabilize service-mesh routing and health-check infrastructure. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score or POC code is provided in the available intelligence, suggesting no confirmed or widespread active exploitation at this time. Despite these mitigating signals, real-world risk is elevated in any environment that issues node-write tokens to principals who are not fully trusted operators-even a mid-sized municipal IT team in ustka operating a shared Consul cluster with role-delegated tokens should treat this as urgent, since the prerequisites (a low-privilege node-write token plus a discoverable node ID) are routinely met in production multi-tenant deployments. SSVC exploitation status defaults to 'none' absent KEV or POC confirmation, but the technical impact on affected node identities is effectively total.

An attacker who has legitimately obtained a Consul ACL token granting node-write permission on their own node queries the catalog read API-accessible at the same privilege level-to enumerate node IDs belonging to high-value nodes such as primary database or API-gateway registrations. Using the discovered node ID, the attacker issues a catalog node-write delete or registration-overwrite request targeting the victim node; because the authorization check passes on the attacker's token scope, the operation succeeds, evicting the legitimate node from the catalog and allowing the attacker to re-register a replacement entry under their control. The attacker then impersonates the victim node's service registrations within the mesh, potentially intercepting traffic routed to that identity and disrupting health checks for downstream consumers.