Is CVE-2026-105765 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105765 being exploited in the wild.

How severe is CVE-2026-105765?

High severity, with a CVSS score of 7.5, published 26 October 2026.

Which products and versions are affected?

HashiCorp Consul 1.17.0 to 2.0.4; HashiCorp Consul Enterprise 1.17.0 to 2.0.4.

How is CVE-2026-105765 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105765?

Check whether you run HashiCorp Consul or HashiCorp Consul Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105765: HashiCorp Consul authorization bypass in service mesh leaf certificate API

CVE-2026-105765 · Severity: high · CVSS 7.5 · Published 2026-10-26

HashiCorp Consul is a service mesh platform that issues and manages security certificates for services to communicate securely. An attacker without valid credentials can retrieve cached service certificates and private keys from the agent's HTTP API, potentially allowing them to impersonate services and access resources they should not be able to reach. This affects organizations with ACL security enabled running Consul versions 1.17.0 through 2.0.4.

Technologies: HashiCorp Consul, HashiCorp Consul Enterprise. Vendors: HashiCorp.

Quick answers

Is CVE-2026-105765 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105765 being exploited in the wild.
How severe is CVE-2026-105765?: High severity, with a CVSS score of 7.5, published 26 October 2026.
Which products and versions are affected?: HashiCorp Consul 1.17.0 to 2.0.4; HashiCorp Consul Enterprise 1.17.0 to 2.0.4.
Is there a fix for CVE-2026-105765?: Yes: fixed in Consul 2.1.0, Consul Enterprise 2.1.0 and 1.21.19. Until then: Restrict network access to the agent HTTP API to trusted networks only, or use http_config.block_endpoints to block the agent leaf certificate endpoint if Connect-native applications and consul-template configurations on that agent do not depend on it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105765 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105765?: Check whether you run HashiCorp Consul or HashiCorp Consul Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Consul 2.1.0, Consul Enterprise 2.1.0 and 1.21.19

Restrict network access to the agent HTTP API to trusted networks only, or use http_config.block_endpoints to block the agent leaf certificate endpoint if Connect-native applications and consul-template configurations on that agent do not depend on it.

Technical details

The vulnerability is an authorization bypass in the agent's service mesh leaf certificate API endpoint. When a service certificate is already cached on the agent, the endpoint returns it without verifying the caller's ACL token, whereas new certificate issuance properly enforces the service:write ACL requirement. An unauthenticated attacker with network access to the agent HTTP API can exploit this to retrieve cached certificates and their private keys, enabling service impersonation within the mesh. The issue only affects deployments with ACLs enabled.

Affected products

HashiCorp Consul 1.17.0 to 2.0.4
HashiCorp Consul Enterprise 1.17.0 to 2.0.4

Timeline

2026-10-26: disclosed: CVE-2026-105765 published and HCSEC-2026-46 advisory released

References

https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.