CVE-2026-88021: 
Consul vulnerability analysis and mitigation

CVE-2026-88021 is an authorization bypass vulnerability in HashiCorp Consul and Consul Enterprise affecting the Connect service mesh. When generating Envoy RBAC rules to enforce Connect intentions, Consul fails to correctly escape certain characters in service names, namespaces, and partitions, causing authorization rules to match more broadly than intended — potentially allowing a service to reach destinations it is not authorized to access. Affected versions span Consul and Consul Enterprise from 1.9.0 up to (but not including) 2.0.4, with Enterprise-specific fixes also available in 1.21.18 and 1.22.12. The vulnerability was published on September 10, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, HashiCorp Advisory).

The root cause is classified as CWE-185 (Incorrect Regular Expression): Consul does not properly escape special characters when constructing Envoy RBAC policy rules from Connect intention definitions (GitHub Advisory). Specifically, characters in service names, namespaces, or partition identifiers that carry special meaning in regular expressions are passed unescaped into the generated RBAC rules, causing those rules to match a broader set of principals or destinations than the operator intended. An authenticated, low-privileged service within the mesh can exploit this over the network without user interaction by crafting or registering a service name containing regex metacharacters that cause the generated RBAC rule to inadvertently permit access to restricted destination services (HashiCorp Advisory). The attack complexity is low and no elevated privileges beyond a valid service identity in the mesh are required.

Successful exploitation allows an authenticated service within the Consul Connect service mesh to bypass intended access controls and communicate with destination services it should not be authorized to reach, resulting in high confidentiality impact and low integrity impact with no availability impact (GitHub Advisory). In practice, this could expose sensitive internal APIs, data stores, or microservices that rely on Connect intentions as their primary access control boundary. The scope is limited to the affected Consul deployment, but lateral movement within the service mesh is a realistic consequence, particularly in multi-tenant or multi-namespace environments where strict service-to-service isolation is expected (HashiCorp Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.244% (16th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already have a service identity within the Consul mesh (low privileges required), which limits the attack surface compared to unauthenticated vulnerabilities (HashiCorp Advisory).

1. Reconnaissance: Identify a target Consul or Consul Enterprise deployment running a version between 1.9.0 and 2.0.4 with the Connect service mesh enabled and Connect intentions configured to restrict service-to-service communication.
2. Obtain service identity: Register or control a service within the Consul mesh that has a valid mTLS certificate issued by Consul's CA — this represents the "low privilege" precondition.
3. Craft a malicious service name: Register a service (or namespace/partition) whose name contains regex metacharacters (e.g., ., *, +, ?, [, ]) that, when embedded unescaped into the Envoy RBAC rule, cause the rule to match additional principals or destinations beyond those intended.
4. Trigger RBAC rule generation: Cause Consul to regenerate Envoy xDS configuration (e.g., by updating intentions or restarting the service), resulting in the flawed RBAC rule being pushed to Envoy sidecars.
5. Access unauthorized destination: Initiate a connection from the controlled service to a destination service that should be blocked by Connect intentions; the overly broad RBAC rule permits the connection, bypassing the intended access control (HashiCorp Advisory, GitHub Advisory).

• Network: Unexpected mTLS connections between services that should be blocked by Connect intentions; inter-service traffic to destination services not listed in a source service's allow-list intentions.
• Logs: Consul agent or Envoy proxy logs showing successful connections between services where a "deny" intention should have applied; Envoy access logs recording requests from source services to destinations not covered by their configured intentions.
• Configuration Artifacts: Envoy RBAC filter configurations (retrievable via Envoy admin API at /config_dump) containing unescaped regex metacharacters in principal or destination matchers, resulting in overly permissive match patterns.
• Consul Audit Logs: Service registration events for services with names containing special characters (., *, +, ?, [, ], (, )) in environments where such naming conventions are not standard.

HashiCorp has released patched versions that correctly escape special characters when generating Envoy RBAC rules. Users should upgrade to Consul 2.0.4 or, for Consul Enterprise, to 1.21.18, 1.22.12, or 2.0.4 (HashiCorp Advisory, GitHub Advisory). As an interim measure, operators should audit service names, namespaces, and partitions for the presence of regex metacharacters and rename any that contain them. Additionally, reviewing and tightening Connect intentions policies and monitoring service mesh traffic for unauthorized inter-service communications is recommended during and after patching.