CVE-2026-105765High· 7.5▾ TwilightHashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
Consul >= 1.17.0 < 2.1.0consul_enterprise >= 1.17.0 < 2.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105608High· 8.8Consul vulnerable to an authorization bypass in service mesh registration
CVE-2026-105626High· 7.5Consul vulnerable to a denial of service in HTTP APIs
CVE-2026-115804Medium· 6.4Consul vulnerable to an authorization bypass in health check registration
CVE-2026-87090High· 8.3Consul vulnerable to an authorization bypass in the catalog node-write path
CVE-2026-87106Medium· 6.5Consul vulnerable to a denial of service in the native RPC listener
CVE-2026-87107Medium· 5.4Consul vulnerable to an authorization bypass in the catalog deregistration path