HashiCorp Consul CVE-2026-87106

Exploitation requires the attacker to hold a valid TLS client certificate trusted by the target Consul cluster's CA - sufficient to complete the internal RPC mTLS handshake - and network-level reachability to the native RPC listener (default TCP port 8300). A valid ACL token is explicitly NOT required; the description confirms that the memory exhaustion occurs before ACL authorization is evaluated. Exploitation is limited to the native RPC protocol surface and does not affect the HTTP API. Exploitation is further limited to clients enrolled in the cluster's mTLS PKI, meaning the attacker must be a current or formerly trusted internal entity. No user interaction is required once port 8300 is accessible and a valid client certificate is held.

The CVSS 6.5 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the nature of this issue: network-accessible, low-complexity, requiring only low-level credentials (valid mTLS client certificate), with purely availability impact. The PR:L designation is the key mitigating factor - exploitation requires possession of a client certificate trusted by the target Consul cluster, which is a meaningful barrier compared to fully unauthenticated attacks. No EPSS score is provided in the available data, and there is no CISA KEV listing and no public POC, indicating no confirmed active exploitation. In environments with tight mTLS certificate controls and strict network segmentation around the internal RPC port (8300), the realistic attack surface is limited to compromised internal services or insider threats. In looser deployments where client certificates are broadly issued or where port 8300 is reachable from wider network segments, the risk is meaningfully higher and patching should be prioritized. The impact is purely availability - no confidentiality or integrity concerns are indicated by the description or CVSS vector.

An attacker who has obtained a valid Consul RPC mTLS client certificate - through a compromised internal microservice, a stolen private key, or over-broad certificate issuance - connects directly to the Consul server's native RPC port (TCP 8300) and completes the mTLS handshake. Without ever presenting an ACL token, the attacker sends a stream of crafted RPC requests that cause the server to allocate memory for each request before the authorization check runs, progressively exhausting all available server memory and crashing the Consul control plane. No public POC is known at time of analysis, but the exploit primitive is a straightforward memory-exhaustion loop once mTLS credentials are in hand.