Is CVE-2026-87090 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87090 being exploited in the wild.

How severe is CVE-2026-87090?

High severity, with a CVSS score of 8.3, published 10 September 2026.

Which products and versions are affected?

HashiCorp Consul up to 2.0.3; HashiCorp Consul Enterprise up to 1.21.17, 1.22.11, and 2.0.3.

Is there a fix for CVE-2026-87090?

A patch was published on 2026-09-10: Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87090 attacked?

It is attacked over the network.

Am I affected by CVE-2026-87090?

Check whether you run HashiCorp Consul or HashiCorp Consul Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87090: HashiCorp Consul authorization bypass in catalog node-write

CVE-2026-87090 · Severity: high · CVSS 8.3 · Published 2026-09-10

HashiCorp Consul is a service discovery and networking platform used to manage microservices and their communication. An authenticated attacker with limited permissions can delete another node's service registration and impersonate it, disrupting service availability and enabling potential lateral movement. This affects organizations relying on Consul for service mesh and infrastructure orchestration.

Technologies: HashiCorp Consul, HashiCorp Consul Enterprise. Vendors: HashiCorp.

Quick answers

Is CVE-2026-87090 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87090 being exploited in the wild.
How severe is CVE-2026-87090?: High severity, with a CVSS score of 8.3, published 10 September 2026.
Which products and versions are affected?: HashiCorp Consul up to 2.0.3; HashiCorp Consul Enterprise up to 1.21.17, 1.22.11, and 2.0.3.
Is there a fix for CVE-2026-87090?: A patch was published on 2026-09-10: Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87090 attacked?: It is attacked over the network.
Am I affected by CVE-2026-87090?: Check whether you run HashiCorp Consul or HashiCorp Consul Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The catalog node-registration endpoint (PUT /v1/catalog/register) fails to fully validate that a requesting token has authorization over all nodes affected by a write operation. An attacker with an ACL token granted node:write permission on a single node can craft a registration request that modifies or deletes the catalog entry of an unrelated node, provided they know the target node's ID. The vulnerability is an authorization bypass in the node-write path that allows privilege escalation beyond the scope of the token's intended permissions. Exploitation requires a valid ACL token with node:write permission and knowledge of a target node's identifier; deployments without ACLs or with unrestricted node-write policies are unaffected. Patches are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.

Affected products

HashiCorp Consul up to 2.0.3
HashiCorp Consul Enterprise up to 1.21.17, 1.22.11, and 2.0.3

Timeline

2026-09-10: disclosed
2026-09-10: patched: Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4

References

https://discuss.hashicorp.com/t/hcsec-2026-34-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-node-write-path/77736

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.