CVE-2026-87090 PUBLISHED

Consul vulnerable to an authorization bypass in the catalog node-write path

Assigner: HashiCorp
Reserved: 08.09.2026 Published: 10.09.2026 Updated: 10.09.2026

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CVSS Score: 8.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	HashiCorp
Product	Consul
Versions	Default: unaffected affected from 0.1.0 to 2.0.4 (excl.)

Vendor	HashiCorp
Product	Consul Enterprise
Versions	Default: unaffected affected from 0.1.0 to 2.0.4 (excl.)

Credits

This issue was reported to HashiCorp by Raphael Zanarelli.

References

https://discuss.hashicorp.com/t/hcsec-2026-34-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-node-write-path/77736

Problem Types

CWE-863: Incorrect Authorization CWE

Impacts

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs