Bulletin ID: HCSEC-2026-49
Affected Products / Versions: Consul and Consul Enterprise 0.7.2 up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19
Publication Date: October 26, 2026
Summary
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
Background
Consul health checks report the status of nodes and services and are used when determining service health for discovery and routing. Consul ACL service rules control access to service-level registration and health information.
Details
Consul did not consistently authorize changes to an existing health check against the service to which the check was already bound. An authenticated user with service:write permission for a different service registered on the same node could modify or rebind a check belonging to a service they were not authorized to modify. This may alter the affected service’s reported health and influence whether its instances are included in service discovery or mesh routing. This issue requires ACLs to be enabled and the ability to write to a separate service on the same node.
Remediation
Customers should evaluate the risk associated with this issue and consider upgrading to Consul Community Edition 2.1.0 or Consul Enterprise 2.1.0 or 1.21.19.
Acknowledgement
This issue was reported to HashiCorp by Immad Sahin of ZeroTrail.
We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.