EUVD-2026-75700
GHSA-9p3q-p26q-fxxc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
PR:L confirmed as service identity required; C:H for unauthorized access to restricted service data; I:L for unauthorized requests; A:N as no disruption to availability.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
5DescriptionCVE.org
Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Articles & Coverage 2
AnalysisAI
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communicate with destination services it is not authorized to reach. The flaw originates in Consul's Envoy RBAC rule generation: unescaped special characters in service names, namespaces, or partitions cause the generated matching rules to be overly permissive, defeating the Connect intentions authorization model. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The exploiting party must control a service registered within the Consul Connect service mesh (PR:L - a valid service identity/mTLS certificate is required). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) accurately characterizes the threat: exploitation requires network-level access and low privileges (control of a registered service), but once those conditions are met, complexity is low and no user interaction is needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched release immediately: Consul (open-source) 2.0.4; Consul Enterprise 1.21.18, 1.22.12, or 2.0.4 depending on the supported release train in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all HashiCorp Consul deployments and document which services rely on Connect for authorization enforcement. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Consul Enterprise
View allAuthorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-wri
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete servi
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expan
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a networ
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated ne
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated caller
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an a
Same weakness CWE-185 – Incorrect Regular Expression
View allShare
External POC / Exploit Code
Leaving vuln.today