Executive brief
Consul, HashiCorp's service mesh and networking platform, contains a flaw in how it enforces access policies between services. Attackers who control a compromised service could potentially reach destinations they should not have access to by exploiting improper character handling in access control rules. This could allow lateral movement within a Consul-protected infrastructure and bypass intended service-to-service isolation.
Technical details
The vulnerability is an authorization bypass in Consul's Connect service mesh intention enforcement. When Consul generates Envoy RBAC (Role-Based Access Control) rules to enforce Connect intentions, it fails to properly escape certain special characters appearing in service names, namespaces, and partitions. This causes the resulting authorization rules to match a broader set of service identities than intended, allowing an unauthorized service to communicate with protected destinations. The attack requires Connect service mesh to be enabled with active intentions in place; exploitation would occur at runtime when a service attempts to reach a destination. Affected versions are Consul and Consul Enterprise 1.9.0 through 2.0.3; fixes are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.
Affected products
- HashiCorp Consul 1.9.0 through 2.0.3
- HashiCorp Consul Enterprise 1.9.0 through 2.0.3
Timeline
- 2026-09-10: disclosed: HCSEC-2026-37 security advisory published
- 2026-09-10: patched: Fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4