EUVD-2026-75699
GHSA-h73p-f2fq-8x97
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Requires valid low-priv ACL token (PR:L) over network (AV:N); impact limited to catalog deletion with no confidentiality exposure and no scope change.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
4DescriptionCVE.org
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
AnalysisAI
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete services, checks, or nodes that were imported from a peered cluster without holding authority over that peer origin. Affecting Consul through 2.0.3 and Consul Enterprise through 1.21.17/1.22.11/2.0.3, any ACL token holder with service:write or node:write permissions can exploit the missing peer-origin authority check (CWE-863) to disrupt service discovery across cluster peering relationships. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions to both be true simultaneously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L accurately reflects realistic risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Consul 2.0.4 or Consul Enterprise 1.21.18, 1.22.12, or 2.0.4 as appropriate - these are the vendor-confirmed fix versions per HashiCorp advisory HCSEC-2026-36 at https://discuss.hashicorp.com/t/hcsec-2026-36-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-deregistration-path/77738. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Consul Enterprise
View allAuthorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-wri
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communi
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expan
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a networ
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated ne
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated caller
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an a
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today