# HCSEC-2026-34 - Consul vulnerable to an authorization bypass in the catalog node-write path

**URL:** <https://discuss.hashicorp.com/t/hcsec-2026-34-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-node-write-path/77736>\
**Category:** Security\
**Tags:** security-consul\
**Created:** [September 10, 2026, 6:45pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-34-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-node-write-path/77736 "2026-09-10T18:45:04Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![james.warren](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/james.warren/32/44042_2.png) [@james.warren](https://discuss.hashicorp.com/u/james.warren)\
**Post date:** [September 10, 2026, 6:45pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-34-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-node-write-path/77736/1 "2026-09-10T18:45:04Z")

</div>

**Bulletin ID:** HCSEC-2026-34

**Affected Products / Versions:** Consul and Consul Enterprise up to 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.

**Publication Date:** September 10, 2026

**Summary**

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node’s catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

**Background**

Consul’s service catalog allows agents and operators to register nodes, along with their associated services and health checks, using the `PUT /v1/catalog/register` endpoint. Access to node registration operations is controlled by ACL policies that grant `node:write` permission on specific node names. Consul also tracks each node by a stable, unique node ID that persists across renames and is used as a canonical identifier in catalog operations.

**Details**

The catalog node-registration endpoint did not fully validate that a requesting token had permission over all nodes that a write operation could affect. A caller with limited node-write access could submit a crafted registration request that, when applied, affected a node outside the scope of their permitted access, potentially resulting in the loss of that node’s catalog registration and associated services and health checks. Exploiting this issue requires a valid ACL token with `node:write` permission on at least one node, as well as knowledge of an identifier associated with a target node. Consul deployments that do not use ACLs, or in which all operators hold unrestricted node-write permission, are not affected by this issue.

**Remediation**

Customers should evaluate the risk associated with this issue and consider upgrading to Consul 2.0.4 or Consul Enterprise 1.21.18, 1.22.12, or 2.0.4.

**Acknowledgement**

This issue was reported to HashiCorp by Raphael Zanarelli.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._