Authorization Bypass Vulnerability in HashiCorp Consul and Consul Enterprise
CVE-2026-115804

6.4MEDIUM

Key Information:

Vendor

Hashicorp
Status
Consul
Consul Enterprise
Vendor
CVE Published:
26 October 2026

What is CVE-2026-115804?

HashiCorp Consul and Consul Enterprise are susceptible to an authorization bypass vulnerability during health check registration. An authenticated user could exploit this flaw to modify health checks associated with different services operating on the same node, potentially compromising service integrity and availability. This issue was addressed in the updates for both Consul Community Edition and Consul Enterprise, emphasizing the importance of maintaining up-to-date software for security.

Affected Version(s)

Consul 64 bit 0.7.2 < 2.1.0

Consul Enterprise 64 bit 0.7.2 < 2.1.0

References

https://discuss.hashicorp.com/t/hcsec-2026-49-consul-vuln...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was reported to HashiCorp by Immad Sahin of ZeroTrail.
.