Executive brief
HashiCorp Consul is a service discovery and networking platform used to manage microservices and their communication. An authenticated attacker with limited permissions can delete another node's service registration and impersonate it, disrupting service availability and enabling potential lateral movement. This affects organizations relying on Consul for service mesh and infrastructure orchestration.
Technical details
The catalog node-registration endpoint (PUT /v1/catalog/register) fails to fully validate that a requesting token has authorization over all nodes affected by a write operation. An attacker with an ACL token granted node:write permission on a single node can craft a registration request that modifies or deletes the catalog entry of an unrelated node, provided they know the target node's ID. The vulnerability is an authorization bypass in the node-write path that allows privilege escalation beyond the scope of the token's intended permissions. Exploitation requires a valid ACL token with node:write permission and knowledge of a target node's identifier; deployments without ACLs or with unrestricted node-write policies are unaffected. Patches are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.
Affected products
- HashiCorp Consul up to 2.0.3
- HashiCorp Consul Enterprise up to 1.21.17, 1.22.11, and 2.0.3
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4