HCSEC-2026-36 - Consul vulnerable to an authorization bypass in the catalog deregistration path

Bulletin ID: HCSEC-2026-36 Affected Products / Versions: Consul and Consul Enterprise 1.21.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with service:write or node:write permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4. Background Consul cluster peering allows two independent Consul clusters to establish a trusted relationship and share service catalog data. Services exported by one cluster become visible in the importing cluster’s catalog and can be used for cross-cluster service discovery and routing. Access to catalog operations is governed by ACL policies, and peer-imported objects are expected to be managed only through the peering replication path rather than by direct local writes. Details The catalog deregistration endpoint did not fully enforce the ownership boundary between locally registered catalog objects and objects imported through cluster peering. A caller with limited write access could submit a crafted deregistration request that affected peer-imported catalog data outside the scope of their local authorization. This could result in peer-imported services, health checks, or nodes being removed from the importing cluster’s catalog, potentially disrupting service discovery and routing. The exporting cluster’s authoritative state is not modified, and affected data may be restored after a subsequent replication update. Exploiting this issue requires an active cluster peering relationship and a local ACL token with write access to catalog resources. Deployments that d…