HCSEC-2026-34 - Consul vulnerable to an authorization bypass in the catalog node-write path

Bulletin ID: HCSEC-2026-34 Affected Products / Versions: Consul and Consul Enterprise up to 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node’s catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4. Background Consul’s service catalog allows agents and operators to register nodes, along with their associated services and health checks, using the PUT /v1/catalog/register endpoint. Access to node registration operations is controlled by ACL policies that grant node:write permission on specific node names. Consul also tracks each node by a stable, unique node ID that persists across renames and is used as a canonical identifier in catalog operations. Details The catalog node-registration endpoint did not fully validate that a requesting token had permission over all nodes that a write operation could affect. A caller with limited node-write access could submit a crafted registration request that, when applied, affected a node outside the scope of their permitted access, potentially resulting in the loss of that node’s catalog registration and associated services and health checks. Exploiting this issue requires a valid ACL token with node:write permission on at least one node, as well as knowledge of an identifier associated with a target node. Consul deployments that do not use ACLs, or in which all operators hold unrestricted node-write permission, are not affected by this issue. Remediation Customers should evaluate the risk associated with this issue an…