HashiCorp Consul: Authorization bypass in service mesh proxy registration
Summary
HashiCorp Consul and Consul Enterprise contain an authorization bypass in service mesh proxy registration. A user who holds service write permission, but not the mesh write permission normally required, can apply Envoy escape-hatch configuration to a sidecar proxy. Successful exploitation may allow code execution within the proxy, access to or modification of its traffic, or bypass of intention enforcement; the issue only affects deployments with ACLs enabled where principals hold service write without mesh write.
Affected
- HashiCorp Consul 2.0.4 to before 2.1.0
- HashiCorp Consul Enterprise 2.0.4 to before 2.1.0
- HashiCorp Consul Enterprise 1.22.12 and 1.21.18 (per vendor bulletin HCSEC-2026-47)
Default configuration is unaffected.
Fixed in
- Consul Community Edition 2.1.0
- Consul Enterprise 2.1.0
- Consul Enterprise 1.21.19
Fix for Consul Enterprise 1.22.x: Unknown.
Workaround
Unknown. The vendor recommends upgrading. As an interim measure, review ACL tokens with service write permission and remove it where it is not needed.
Exploitation
- Vendor-confirmed; CISA SSVC: exploitation none, automatable no, technical impact total.
- No confirmed in-the-wild exploitation or CISA KEV listing known at time of writing.
- Unverified claim of a public proof-of-concept exploit.
- Requires a valid ACL token with service write permission.
Our recommendation
- Upgrade to Consul 2.1.0 or Consul Enterprise 2.1.0 or 1.21.19.
- Inventory Consul versions and confirm whether ACLs are enabled.
- Review and restrict which tokens and CI/CD pipelines hold service write permission.
- Apply the same upgrade for related HashiCorp bulletins HCSEC-2026-46, -48 and -49 in one patch cycle.
- Monitor Consul audit logs for unexpected proxy registrations.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HashiCorp advisory HCSEC-2026-47 discuss.hashicorp.com
- Ubuntu CVE tracker ubuntu.com
- VulDB vuldb.com
- OffSeq threat radar radar.offseq.com
- OpenCVE CVE-2026-105608 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:31.
Original description (NVD)
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.