CVE-2026-115804

Consul vulnerable to an authorization bypass in health check registration

State: Published
Severity: 6.4 Medium
Published: Oct 26, 2026
Updated: Oct 26, 2026
Reserved: Oct 23, 2026

Description

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L	HashiCorp

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
ConsulHashiCorp	0.7.2 to before 2.1.0Affected
Consul EnterpriseHashiCorp	0.7.2 to before 2.1.0Affectedfrom 1.21.19Not affected

References

https://discuss.hashicorp.com/t/hcsec-2026-49-consul-vulnerable-to-an-authorization-bypass-in-health-check-registration/77914

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.