Medium severity · published Oct 26, 2026
CVE-2026-115804
Consul vulnerable to an authorization bypass in health check registration
New
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Consul · HashiCorp
0.7.2 before 2.1.0 · source: vendor
CE
Consul Enterprise · HashiCorp
0.7.2 before 2.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115804
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115804
discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2026-49-consul-vulnerable-to-an-authorization-bypass-in-health-check-registration/77914
More from Consul
8.8
CVE-2026-105608
Consul vulnerable to an authorization bypass in service mesh registration
8.8
CVE-2021-41805
HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control
8.8
CVE-2021-37219
HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling…
8.6
CVE-2021-3121
An issue was discovered in GoGo Protobuf before 1.3.2
8.3
CVE-2026-87090
Consul vulnerable to an authorization bypass in the catalog node-write path