High severity · published Oct 26, 2026
CVE-2026-105765
Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
New
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Consul · HashiCorp
1.17.0 before 2.1.0 · source: vendor
CE
Consul Enterprise · HashiCorp
1.17.0 before 2.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105765
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105765
discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911
More from Consul
8.8
CVE-2026-105608
Consul vulnerable to an authorization bypass in service mesh registration
8.8
CVE-2021-41805
HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control
8.8
CVE-2021-37219
HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling…
8.6
CVE-2021-3121
An issue was discovered in GoGo Protobuf before 1.3.2
8.3
CVE-2026-87090
Consul vulnerable to an authorization bypass in the catalog node-write path