CVE-2026-87090: 
Consul vulnerability analysis and mitigation

CVE-2026-87090 is an authorization bypass vulnerability in HashiCorp Consul and Consul Enterprise affecting the catalog node-write path. It allows an authenticated attacker to delete another node's catalog registration and take over its node identity. The vulnerability affects Consul versions from 0.1.0 up to (but not including) 2.0.4, and Consul Enterprise versions prior to 1.21.18, 1.22.12, and 2.0.4. It was published on September 10, 2026, and carries a CVSS v3.1 base score of 8.3 (High) (Github Advisory, HashiCorp Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization), with an estimated secondary classification of CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability exists in the catalog node-write API path, where Consul fails to correctly validate that a token's node-write permission is scoped to the specific node being targeted. An attacker who possesses a valid token granting node-write permission on any single node name can supply the node ID of a different, uncontrolled node to perform unauthorized delete or registration-takeover operations. The precondition for exploitation requires the attacker to be authenticated (low-privilege token) and able to obtain the node ID of a target node they do not control (Github Advisory, HashiCorp Advisory).

A successful exploit allows an authenticated attacker to delete another node's catalog registration and assume that node's identity within the Consul service mesh. This results in high integrity and availability impact — the attacker can disrupt service discovery for the targeted node and impersonate it to other services, potentially enabling lateral movement within the cluster. Confidentiality impact is rated low, as some catalog metadata may be exposed in the process of obtaining a target node ID (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (HashiCorp Advisory). The EPSS score is approximately 0.207%, placing it in the 11th percentile for exploitation likelihood within 30 days. The NVD SSVC assessment indicates exploitation is currently "none" and the attack is not automatable. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Obtain a valid Consul token: Acquire an authenticated Consul ACL token that grants node-write permission on at least one node name — this could be a legitimately issued token or one obtained through credential theft.
2. Enumerate node IDs: Query the Consul catalog API (e.g., GET /v1/catalog/nodes) using the attacker's token or any read-permitted token to enumerate registered nodes and retrieve the node IDs of nodes the attacker does not control.
3. Identify a target node: Select a high-value target node (e.g., a service gateway or critical infrastructure node) whose node ID has been obtained.
4. Craft a malicious catalog registration/delete request: Send a crafted API request to the catalog node-write endpoint (e.g., PUT /v1/catalog/register or PUT /v1/catalog/deregister) supplying the target node's ID while authenticating with the attacker's token, bypassing the authorization check.
5. Delete or take over node identity: The server incorrectly authorizes the request, allowing the attacker to deregister the target node from the catalog or register a replacement node under the same identity, disrupting services or enabling impersonation (Github Advisory, HashiCorp Advisory).

• Logs: Consul audit logs showing node deregistration or registration events (catalog/deregister or catalog/register) performed by a token that does not match the expected owner of the affected node; repeated catalog write operations from a single token targeting multiple different node IDs.
• Network: Unexpected API calls to /v1/catalog/register or /v1/catalog/deregister endpoints from unusual source IPs or service accounts; bulk enumeration requests to /v1/catalog/nodes preceding write operations.
• Consul Catalog: Sudden disappearance of node registrations from the catalog without corresponding node shutdowns; nodes re-registering with unexpected metadata or service configurations.
• Process/Service: Services reporting loss of connectivity to nodes that were unexpectedly deregistered; health check failures for nodes that are still operationally running.

HashiCorp has released patched versions addressing this vulnerability: Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Organizations should upgrade to one of these versions as the primary remediation. As interim mitigations, restrict the issuance of node-write ACL tokens to trusted operators only, and implement network segmentation to limit an attacker's ability to enumerate node IDs. Monitoring Consul audit logs for unexpected node deregistration or identity-change events is also recommended (HashiCorp Advisory, Github Advisory).

The vulnerability was disclosed by HashiCorp via their security advisory forum (HCSEC-2026-34) on September 10, 2026, with patches made simultaneously available. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability database aggregation. The disclosure appears to have followed a coordinated vendor-led process with no public controversy (HashiCorp Advisory).