CVE-2026-87107: 
Consul vulnerability analysis and mitigation

CVE-2026-87107 is an authorization bypass vulnerability in HashiCorp Consul and Consul Enterprise affecting the catalog deregistration path. It allows an authenticated caller holding service:write or node:write ACL permissions to delete services, checks, or nodes that were imported from a peered cluster, without holding authority over the peer origin. Affected versions span from 1.21.0 up to (but not including) 2.0.4 for both Consul and Consul Enterprise. The vulnerability was published on September 10, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory, HashiCorp Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the catalog deregistration code path does not correctly verify whether the caller holds authority over the peer origin of imported catalog objects. When a user with service:write or node:write permissions submits a deregistration request, the authorization check fails to distinguish between locally-owned objects and those imported from a peered cluster, allowing the operation to proceed without the required peer-origin authority. This is a network-accessible flaw (attack vector: Network) requiring low privileges and no user interaction, making it straightforward to exploit for any authenticated ACL token holder (Github Advisory, HashiCorp Advisory).

Successful exploitation allows an authenticated attacker to remove services, health checks, or nodes that were imported from a peered cluster, impacting both the integrity and availability of the Consul service catalog. This could disrupt service discovery across peered clusters, potentially causing downstream application failures or masking the presence of critical services. There is no confidentiality impact, as the vulnerability does not expose sensitive data, but the ability to silently deregister peer-imported objects could facilitate denial-of-service conditions or complicate incident response in multi-cluster environments (Github Advisory, HashiCorp Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.23% (14th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" with the attack noted as non-automatable.

1. Obtain a valid ACL token: Acquire or compromise a Consul ACL token that has service:write or node:write permissions on the local cluster.
2. Identify peer-imported catalog objects: Query the Consul catalog API (e.g., GET /v1/catalog/services or GET /v1/catalog/nodes) to enumerate services, checks, or nodes that have been imported from a peered cluster.
3. Craft a deregistration request: Construct a catalog deregistration API call (e.g., PUT /v1/catalog/deregister) targeting a peer-imported service, node, or check, using the obtained ACL token for authentication.
4. Submit the request: Send the deregistration request to the vulnerable Consul API endpoint. Due to the missing peer-origin authorization check, the request succeeds even though the caller lacks authority over the peer origin.
5. Achieve impact: The targeted peer-imported catalog object is removed from the local cluster's service catalog, disrupting service discovery for dependent applications (HashiCorp Advisory, Github Advisory).

• Logs: Consul audit logs showing PUT /v1/catalog/deregister requests for peer-imported services or nodes, originating from ACL tokens that do not belong to the peer cluster's administrative role.
• Logs: Unexpected deregistration events in Consul's system logs for services or nodes tagged with a peer origin (e.g., entries referencing PeerName fields being removed).
• Network: API calls to the /v1/catalog/deregister endpoint from internal clients that do not normally perform deregistration operations, especially targeting objects from peered clusters.
• Behavioral: Sudden disappearance of peer-imported services or nodes from the Consul catalog without corresponding changes in the originating peer cluster.

HashiCorp has released patched versions addressing this vulnerability: Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Organizations should upgrade to one of these versions as the primary remediation. As an interim measure, review and audit ACL policies to enforce least-privilege assignment of service:write and node:write permissions, restricting these only to users and services that operationally require them (HashiCorp Advisory, Github Advisory).

HashiCorp disclosed the vulnerability via their security advisory forum (HCSEC-2026-36) on September 10, 2026, providing patched versions and remediation guidance. No notable independent researcher commentary or significant social media discussion has been identified at this time.