CVE-2026-87107 PUBLISHED

Consul vulnerable to an authorization bypass in the catalog deregistration path

Assigner: HashiCorp
Reserved: 08.09.2026 Published: 10.09.2026 Updated: 10.09.2026

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 5.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	HashiCorp
Product	Consul
Versions	Default: unaffected affected from 1.21.0 to 2.0.4 (excl.)

Vendor	HashiCorp
Product	Consul Enterprise
Versions	Default: unaffected affected from 1.21.0 to 2.0.4 (excl.)

Credits

This issue was reported to HashiCorp by Yazdan Soltani.

References

https://discuss.hashicorp.com/t/hcsec-2026-36-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-deregistration-path/77738

Problem Types

CWE-863: Incorrect Authorization CWE

Impacts

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs