Vulnerability · Published Sep 10, 2026 · Assigned by HashiCorp
CVE-2026-87090Consul vulnerable to an authorization bypass in the catalog node-write path
High 8.3
In plain English
A high-severity incorrect authorization in Consul from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | consul | no fix listed | UBUNTU-CVE-2026-87090 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Consul | 0.1.0 – before 2.0.4 |
| HashiCorp | Consul Enterprise | 0.1.0 – before 2.0.4 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H