Denial of Service Vulnerability in Consul and Consul Enterprise by HashiCorp
CVE-2026-87106

6.5MEDIUM

Key Information:

Vendor

Hashicorp
Status
Consul
Consul Enterprise
Vendor
CVE Published:
10 September 2026

What is CVE-2026-87106?

An authenticated client can exploit a vulnerability in the native RPC listener of Consul and Consul Enterprise, potentially exhausting server memory before ACL authorization is checked. This happens through a mTLS handshake, allowing access without a valid ACL token. The issue affects Consul and its enterprise version, and it has been addressed in recent updates.

Affected Version(s)

Consul 64 bit 1.21.0 < 2.0.4

Consul Enterprise 64 bit 1.21.0 < 2.0.4

References

https://discuss.hashicorp.com/t/hcsec-2026-35-consul-vuln...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was reported to HashiCorp by Yazdan Soltani.
.