Bulletin ID: HCSEC-2026-36
Affected Products / Versions: Consul and Consul Enterprise 1.21.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.
Publication Date: September 10, 2026
Summary
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with service:write or node:write permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Background
Consul cluster peering allows two independent Consul clusters to establish a trusted relationship and share service catalog data. Services exported by one cluster become visible in the importing cluster’s catalog and can be used for cross-cluster service discovery and routing. Access to catalog operations is governed by ACL policies, and peer-imported objects are expected to be managed only through the peering replication path rather than by direct local writes.
Details
The catalog deregistration endpoint did not fully enforce the ownership boundary between locally registered catalog objects and objects imported through cluster peering. A caller with limited write access could submit a crafted deregistration request that affected peer-imported catalog data outside the scope of their local authorization. This could result in peer-imported services, health checks, or nodes being removed from the importing cluster’s catalog, potentially disrupting service discovery and routing. The exporting cluster’s authoritative state is not modified, and affected data may be restored after a subsequent replication update. Exploiting this issue requires an active cluster peering relationship and a local ACL token with write access to catalog resources. Deployments that do not use Consul cluster peering are not affected.
Remediation
Customers should evaluate the risk associated with this issue and consider upgrading to Consul 2.0.4 or Consul Enterprise 1.21.18, 1.22.12, or 2.0.4.
Acknowledgement
This issue was reported to HashiCorp by Yazdan Soltani.
We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.