# HashiCorp Consul vulnerabilities Source: https://junglewise.ai/threats/technologies/consul Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/consul.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in HashiCorp Consul: 0 in the last 7 days and 8 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115804, was published on 26 October 2026. 4 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 4 - Last 90 days: 8 - All time: 11 (0 critical, 0 exploited in the wild) ## About HashiCorp Consul A service networking solution that provides a service mesh, service discovery, and configuration management. ## Latest HashiCorp Consul vulnerabilities - [CVE-2026-115804: HashiCorp Consul authorization bypass in health check registration](https://junglewise.ai/threats/cve-2026-115804-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-an) (medium, CVSS 6.4, published 26 Oct 2026) - [CVE-2026-105765: HashiCorp Consul authorization bypass in service mesh leaf certificate API](https://junglewise.ai/threats/cve-2026-105765-hashicorp-consul-and-consul-enterprise-1-17-0-up-to-2-0-4-are) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-105626: HashiCorp Consul HTTP API denial of service](https://junglewise.ai/threats/cve-2026-105626-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-a) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-105608: HashiCorp Consul authorization bypass in service mesh proxy registration](https://junglewise.ai/threats/cve-2026-105608-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-an) (high, CVSS 8.8, published 26 Oct 2026) - [CVE-2026-88021: HashiCorp Consul authorization bypass in Connect service mesh](https://junglewise.ai/threats/cve-2026-88021-hashicorp-consul-authorization-bypass-in-connect-service-mesh) (high, CVSS 7.1, published 10 Sep 2026) - [CVE-2026-87107: HashiCorp Consul authorization bypass in catalog deregistration](https://junglewise.ai/threats/cve-2026-87107-hashicorp-consul-authorization-bypass-in-catalog-deregistration) (medium, CVSS 5.4, published 10 Sep 2026) - [CVE-2026-87106: HashiCorp Consul denial of service in native RPC listener](https://junglewise.ai/threats/cve-2026-87106-hashicorp-consul-denial-of-service-in-native-rpc-listener) (medium, CVSS 6.5, published 10 Sep 2026) - [CVE-2026-87090: HashiCorp Consul authorization bypass in catalog node-write](https://junglewise.ai/threats/cve-2026-87090-hashicorp-consul-authorization-bypass-in-catalog-node-write) (high, CVSS 8.3, published 10 Sep 2026) - [CVE-2026-14362: HashiCorp memberlist denial of service in push/pull state handling](https://junglewise.ai/threats/cve-2026-14362-hashicorp-memberlist-denial-of-service-in-push-pull-state) (medium, CVSS 4.9, published 8 Jul 2026) - [CVE-2025-11375: GO-2025-4082 - Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul](https://junglewise.ai/threats/cve-2025-11375-consul-event-endpoint-is-vulnerable-to-denial-of-service) (medium, CVSS 6.5, published 28 Oct 2025) - [CVE-2025-11374: GO-2025-4081 - Consul key/value endpoint is vulnerable to denial of service in github.com/hashicorp/consul](https://junglewise.ai/threats/cve-2025-11374-consul-key-value-endpoint-is-vulnerable-to-denial-of-service) (medium, CVSS 6.5, published 28 Oct 2025) ## Most severe HashiCorp Consul vulnerabilities - [CVE-2026-105608: HashiCorp Consul authorization bypass in service mesh proxy registration](https://junglewise.ai/threats/cve-2026-105608-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-an) (high, CVSS 8.8, published 26 Oct 2026) - [CVE-2026-87090: HashiCorp Consul authorization bypass in catalog node-write](https://junglewise.ai/threats/cve-2026-87090-hashicorp-consul-authorization-bypass-in-catalog-node-write) (high, CVSS 8.3, published 10 Sep 2026) - [CVE-2026-105765: HashiCorp Consul authorization bypass in service mesh leaf certificate API](https://junglewise.ai/threats/cve-2026-105765-hashicorp-consul-and-consul-enterprise-1-17-0-up-to-2-0-4-are) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-105626: HashiCorp Consul HTTP API denial of service](https://junglewise.ai/threats/cve-2026-105626-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-a) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-88021: HashiCorp Consul authorization bypass in Connect service mesh](https://junglewise.ai/threats/cve-2026-88021-hashicorp-consul-authorization-bypass-in-connect-service-mesh) (high, CVSS 7.1, published 10 Sep 2026) - [CVE-2025-11375: GO-2025-4082 - Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul](https://junglewise.ai/threats/cve-2025-11375-consul-event-endpoint-is-vulnerable-to-denial-of-service) (medium, CVSS 6.5, published 28 Oct 2025) - [CVE-2025-11374: GO-2025-4081 - Consul key/value endpoint is vulnerable to denial of service in github.com/hashicorp/consul](https://junglewise.ai/threats/cve-2025-11374-consul-key-value-endpoint-is-vulnerable-to-denial-of-service) (medium, CVSS 6.5, published 28 Oct 2025) - [CVE-2026-87106: HashiCorp Consul denial of service in native RPC listener](https://junglewise.ai/threats/cve-2026-87106-hashicorp-consul-denial-of-service-in-native-rpc-listener) (medium, CVSS 6.5, published 10 Sep 2026) - [CVE-2026-115804: HashiCorp Consul authorization bypass in health check registration](https://junglewise.ai/threats/cve-2026-115804-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-an) (medium, CVSS 6.4, published 26 Oct 2026) - [CVE-2026-87107: HashiCorp Consul authorization bypass in catalog deregistration](https://junglewise.ai/threats/cve-2026-87107-hashicorp-consul-authorization-bypass-in-catalog-deregistration) (medium, CVSS 5.4, published 10 Sep 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 4 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 4 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other HashiCorp technologies - [HashiCorp Vault](https://junglewise.ai/threats/technologies/vault): 11 vulnerabilities - [HashiCorp Nomad](https://junglewise.ai/threats/technologies/nomad): 9 vulnerabilities - [HashiCorp Vault Enterprise](https://junglewise.ai/threats/technologies/vault-enterprise): 9 vulnerabilities - [HashiCorp Consul Enterprise](https://junglewise.ai/threats/technologies/consul-enterprise): 8 vulnerabilities - [HashiCorp Nomad Enterprise](https://junglewise.ai/threats/technologies/nomad-enterprise): 8 vulnerabilities - [HashiCorp Consul-Template](https://junglewise.ai/threats/technologies/consul-template): 3 vulnerabilities - [HashiCorp Terraform MCP Server](https://junglewise.ai/threats/technologies/terraform-mcp-server): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "HashiCorp Consul vulnerabilities", https://junglewise.ai/threats/technologies/consul, 13 November 2026.