Quick answers
- Is CVE-2026-105608 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105608 being exploited in the wild.
- How severe is CVE-2026-105608?
- High severity, with a CVSS score of 8.8, published 26 October 2026.
- Which products and versions are affected?
- HashiCorp Consul 2.0.4, prior to 2.1.0; HashiCorp Consul Enterprise 2.0.4, 1.22.12, prior to 2.1.0 and 1.21.19.
- Is there a fix for CVE-2026-105608?
- Yes: fixed in Consul 2.1.0, Consul Enterprise 2.1.0 and 1.21.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-105608 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-105608?
- Check whether you run HashiCorp Consul or HashiCorp Consul Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Consul 2.1.0, Consul Enterprise 2.1.0 and 1.21.19
Technical details
The vulnerability exists in Consul's permission checking for Envoy escape-hatch configuration overrides in proxy registration. The permission validator recognizes fewer key name spellings than the configuration processor, allowing an attacker to supply override configuration using an alternative key spelling that bypasses the mesh write permission check. An authenticated attacker with service write permission on a proxy and its destination service, but without mesh write permission, can inject arbitrary Envoy configuration that Consul will apply.
Affected products
- HashiCorp Consul 2.0.4, prior to 2.1.0
- HashiCorp Consul Enterprise 2.0.4, 1.22.12, prior to 2.1.0 and 1.21.19
Timeline
- 2026-10-26: disclosed: HCSEC-2026-47 advisory published
- 2026-10-26: patched: Consul 2.1.0, Consul Enterprise 2.1.0 and 1.21.19 released