# CVE-2026-105765: HashiCorp Consul authorization bypass in service mesh leaf certificate API

Source: https://junglewise.ai/threats/cve-2026-105765-hashicorp-consul-and-consul-enterprise-1-17-0-up-to-2-0-4-are  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-105765 · Severity: high · CVSS 7.5 · Published 2026-10-26

HashiCorp Consul is a service mesh platform that issues and manages security certificates for services to communicate securely. An attacker without valid credentials can retrieve cached service certificates and private keys from the agent's HTTP API, potentially allowing them to impersonate services and access resources they should not be able to reach. This affects organizations with ACL security enabled running Consul versions 1.17.0 through 2.0.4.

Technologies: [HashiCorp Consul](https://junglewise.ai/threats/technologies/consul), [HashiCorp Consul Enterprise](https://junglewise.ai/threats/technologies/consul-enterprise). Vendors: [HashiCorp](https://junglewise.ai/threats/vendors/hashicorp).

## Quick answers

**Is CVE-2026-105765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105765 being exploited in the wild.

**How severe is CVE-2026-105765?** High severity, with a CVSS score of 7.5, published 26 October 2026.

**Which products and versions are affected?** HashiCorp Consul 1.17.0 to 2.0.4; HashiCorp Consul Enterprise 1.17.0 to 2.0.4.

**Is there a fix for CVE-2026-105765?** Yes: fixed in Consul 2.1.0, Consul Enterprise 2.1.0 and 1.21.19. Until then: Restrict network access to the agent HTTP API to trusted networks only, or use http_config.block_endpoints to block the agent leaf certificate endpoint if Connect-native applications and consul-template configurations on that agent do not depend on it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105765 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105765?** Check whether you run HashiCorp Consul or HashiCorp Consul Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Consul 2.1.0, Consul Enterprise 2.1.0 and 1.21.19

Restrict network access to the agent HTTP API to trusted networks only, or use http_config.block_endpoints to block the agent leaf certificate endpoint if Connect-native applications and consul-template configurations on that agent do not depend on it.

## Technical details

The vulnerability is an authorization bypass in the agent's service mesh leaf certificate API endpoint. When a service certificate is already cached on the agent, the endpoint returns it without verifying the caller's ACL token, whereas new certificate issuance properly enforces the service:write ACL requirement. An unauthenticated attacker with network access to the agent HTTP API can exploit this to retrieve cached certificates and their private keys, enabling service impersonation within the mesh. The issue only affects deployments with ACLs enabled.

## Affected products

- HashiCorp Consul 1.17.0 to 2.0.4
- HashiCorp Consul Enterprise 1.17.0 to 2.0.4

## Timeline

- 2026-10-26: disclosed: CVE-2026-105765 published and HCSEC-2026-46 advisory released

## References

- [https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911](https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911)

## Related threats

- [HashiCorp Consul authorization bypass in health check registration](https://junglewise.ai/threats/cve-2026-115804-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-an)
- [HashiCorp Consul HTTP API denial of service](https://junglewise.ai/threats/cve-2026-105626-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-a)
- [HashiCorp Consul authorization bypass in service mesh proxy registration](https://junglewise.ai/threats/cve-2026-105608-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-an)
- [HashiCorp Consul authorization bypass in Connect service mesh](https://junglewise.ai/threats/cve-2026-88021-hashicorp-consul-authorization-bypass-in-connect-service-mesh)
- [HashiCorp Consul authorization bypass in catalog deregistration](https://junglewise.ai/threats/cve-2026-87107-hashicorp-consul-authorization-bypass-in-catalog-deregistration)