Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1085 _____________________________________________________________________ DATE : 27/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Consul versions prior to 2.1.0, Consul Enterprise versions prior to 2.1.0, 1.21.19. ==================================================================== https://discuss.hashicorp.com/t/hcsec-2026-47-consul-vulnerable-to-an-authorization-bypass-in-service-mesh-registration/77912 https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911 https://discuss.hashicorp.com/t/hcsec-2026-48-consul-vulnerable-to-a-denial-of-service-in-http-apis/77913 https://discuss.hashicorp.com/t/hcsec-2026-49-consul-vulnerable-to-an-authorization-bypass-in-health-check-registration/77914 _____________________________________________________________________ HCSEC-2026-47 - Consul vulnerable to an authorization bypass in service mesh registration Security security-consul james.warren Bulletin ID: HCSEC-2026-47 Affected Products / Versions: Consul 2.0.4 and Consul Enterprise 2.0.4, 1.22.12 and 1.21.18; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Background Consul service mesh supports Envoy escape-hatch overrides, which let operators supply raw Envoy configuration in a proxy’s service registration to replace configuration that Consul would otherwise generate. Because these overrides can change how the sidecar proxy handles traffic, Consul requires the mesh write permission, in addition to service write, to register a proxy that sets them. Details Consul’s permission check identified escape-hatch overrides by key name, but recognized fewer key spellings than the configuration processing that later applies them. As a result, a crafted proxy registration could supply an override using an equivalent key spelling that the check did not recognize but Consul still applied. An authenticated user with service write permission on a proxy and its destination service, but without mesh write, could inject arbitrary Envoy configuration into that sidecar proxy. This could potentially allow code execution within the proxy, access to or modification of the traffic it handles, or bypass of intention enforcement at that proxy. This issue only affects deployments with ACLs enabled in which principals hold service write permission without mesh write. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Consul Community Edition 2.1.0 or Consul Enterprise 2.1.0 or 1.21.19. Acknowledgement This issue was reported to HashiCorp by Immad Sahin of ZeroTrail and Yonghwa Lee of Theori. We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security. _____________________________________________________________________ HCSEC-2026-46 - Consul vulnerable to an authorization bypass in the agent’s service mesh leaf certificate API Security security-consul james.warren Bulletin ID: HCSEC-2026-46 Affected Products / Versions: Consul and Consul Enterprise 1.17.0 up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent’s service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Background Consul service mesh issues each service a leaf certificate, which proxies and Connect-native applications use to establish mutual TLS (mTLS) connections and to identify the service to other services in the mesh. Consul agents can return a service’s leaf certificate and private key through the agent HTTP API, and cache issued certificates to reduce load on Consul servers. Details Consul agents enforced the service:write requirement only when a new leaf certificate had to be issued. When a valid certificate for the requested service was already cached on the agent, the agent returned it without verifying the caller’s ACL token. An attacker with network access to the agent’s HTTP API could retrieve that certificate and its private key without a valid ACL token, and could potentially use them to impersonate the service in the mesh and reach services that intentions permit for that identity. Exposure is limited to certificates already cached on the reachable agent, which typically includes services whose sidecar proxies are managed by that agent; Consul servers that manage proxies for Consul Dataplane deployments may cache certificates for many services. This issue only affects deployments with ACLs enabled. By default, the agent HTTP API listens only on the loopback interface, which limits exposure to processes on the same host. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Consul Community Edition 2.1.0 or Consul Enterprise 2.1.0 or 1.21.19. Customers that cannot upgrade immediately may restrict network access to the agent HTTP API, or block the agent leaf certificate endpoint with http_config.block_endpoints if no Connect-native applications or consul-template configurations on that agent depend on it. Acknowledgement This issue was reported to HashiCorp by Tomas Castillo (muertostech · GitHub). We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security. _____________________________________________________________________ HCSEC-2026-48 - Consul vulnerable to a denial of service in HTTP APIs Security security-consul james.warren Bulletin ID: HCSEC-2026-48 Affected Products / Versions: Consul and Consul Enterprise up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Background Consul client and server agents expose an HTTP API for operations such as registering services and managing configuration. Requests are authorized with ACL tokens, and for many write operations the caller’s permissions are evaluated after the request has been received and processed by the agent. Details Several Consul HTTP API endpoints read and decoded the entire request body into memory without a size limit before the caller’s ACL permissions were evaluated. An attacker with network access to an agent’s HTTP API could send very large request bodies, including to endpoints that do not require authentication, causing excessive memory consumption. Large or concurrent requests could degrade the agent or cause the operating system to terminate it, resulting in a denial of service. The issue requires network access to the HTTP API but does not require a valid ACL token. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Consul Community Edition 2.1.0 or Consul Enterprise 2.1.0 or 1.21.19. After upgrading, most HTTP API write endpoints reject request bodies larger than 512 KiB, so operators who submit unusually large payloads, such as large configuration entries, should confirm their requests stay within this limit. Acknowledgement This issue was reported to HashiCorp by Immad Sahin of ZeroTrail. We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security. _____________________________________________________________________ HCSEC-2026-49 - Consul vulnerable to an authorization bypass in health check registration Security security-consul james.warren 19h Bulletin ID: HCSEC-2026-49 Affected Products / Versions: Consul and Consul Enterprise 0.7.2 up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Background Consul health checks report the status of nodes and services and are used when determining service health for discovery and routing. Consul ACL service rules control access to service-level registration and health information. Details Consul did not consistently authorize changes to an existing health check against the service to which the check was already bound. An authenticated user with service:write permission for a different service registered on the same node could modify or rebind a check belonging to a service they were not authorized to modify. This may alter the affected service’s reported health and influence whether its instances are included in service discovery or mesh routing. This issue requires ACLs to be enabled and the ability to write to a separate service on the same node. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Consul Community Edition 2.1.0 or Consul Enterprise 2.1.0 or 1.21.19. Acknowledgement This issue was reported to HashiCorp by Immad Sahin of ZeroTrail. We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================