CVE-2026-105765

Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API

HashiCorp Consul

Open in Threatline Record JSON

CVSS

7.5High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in2.1.0Fixed versionCVE List

Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

2.1.0ConsulCVE List
2.1.0Consul EnterpriseCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@cve.skyfleet.blue: CVE-2026-105765 - HCSEC-2026-46 - Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API CVE ID : CVE-2026-105765 Published : Oct. 26, 2026, Bluesky: CVE posts, 26 Oct 2026

Description

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

Text from CVE List

Affected versions 2

Consulaffected: 1.17.0 before 2.1.0CVE List
Consul Enterpriseaffected: 1.17.0 before 2.1.0CVE List

References 1

discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911Advisoryvia CVE List