Bulletin ID: HCSEC-2026-37
Affected Products / Versions: Consul and Consul Enterprise 1.9.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.
Publication Date: September 10, 2026
Summary
Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Background
Consul’s Connect service mesh uses intentions to define which services are allowed to communicate with each other. When a Connect proxy is configured, Consul generates Envoy RBAC rules that enforce these intentions by matching the caller’s SPIFFE identity against the permitted identities for the destination service. These patterns are derived from service names, namespaces, and partitions registered in the Consul catalog.
Details
The authorization rules Consul generated for Connect service mesh intention enforcement did not correctly handle certain characters that may appear in service names, namespaces, and partitions. This could cause the generated rules to match a broader set of service identities than the operator intended, potentially allowing a caller to reach a destination service through an existing intention that was not created for them. This issue requires Connect service mesh to be enabled with active intentions. Deployments where catalog names do not contain the affected characters are not impacted in practice.
Remediation
Customers should evaluate the risk associated with this issue and consider upgrading to Consul 2.0.4 or Consul Enterprise 1.21.18, 1.22.12, or 2.0.4.
Acknowledgement
This issue was reported to HashiCorp by Đoàn Thành.
We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.