HashiCorp Consul CVE-2026-88021

The exploiting party must control a service registered within the Consul Connect service mesh (PR:L - a valid service identity/mTLS certificate is required). Exploitation is facilitated when service names, namespaces, or partitions contain special characters that are not correctly escaped in Envoy RBAC rule generation - these characters may be naturally present in naming conventions or deliberately crafted. The Connect service mesh feature and Envoy sidecar integration must be in use; installations using Consul purely for service discovery without Connect/Envoy are not affected by this specific vector. No user interaction is required and attack complexity is low once the character condition is met. Exploitation is limited to authorized services within the mesh - external unauthenticated attackers cannot exploit this without first establishing a registered service identity.

The CVSS 7.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) accurately characterizes the threat: exploitation requires network-level access and low privileges (control of a registered service), but once those conditions are met, complexity is low and no user interaction is needed. The high confidentiality impact reflects that an exploiting service can read data from unauthorized backend services; the low integrity impact reflects the ability to make unauthorized requests. No EPSS score or KEV listing is present in the input data, and no public POC has been identified, suggesting this is not yet being opportunistically exploited. Real-world risk is meaningful in environments that rely on Consul Connect intentions as a primary lateral-movement control: a compromised service with a specially crafted or naturally occurring special-character name/namespace could silently bypass intended segmentation, enabling east-west lateral movement within the mesh. Organizations without additional network controls (e.g., network-level firewalls between services) are most exposed.

An attacker who has compromised a microservice registered in the Consul Connect mesh - or who operates a legitimately registered service whose name contains unescaped special characters - sends traffic directly toward a high-value internal service that intentions should prohibit. Because Consul generated an overly broad Envoy RBAC rule for the destination, Envoy permits the connection and the attacker's service can read sensitive API responses or internal data from the destination. No public POC exists, but the straightforward nature of the flaw (AC:L) means exploitation requires only identifying the character-matching condition.