HCSEC-2026-37 - Consul vulnerable to an authorization bypass in the Connect service mesh

Bulletin ID: HCSEC-2026-37 Affected Products / Versions: Consul and Consul Enterprise 1.9.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4. Background Consul’s Connect service mesh uses intentions to define which services are allowed to communicate with each other. When a Connect proxy is configured, Consul generates Envoy RBAC rules that enforce these intentions by matching the caller’s SPIFFE identity against the permitted identities for the destination service. These patterns are derived from service names, namespaces, and partitions registered in the Consul catalog. Details The authorization rules Consul generated for Connect service mesh intention enforcement did not correctly handle certain characters that may appear in service names, namespaces, and partitions. This could cause the generated rules to match a broader set of service identities than the operator intended, potentially allowing a caller to reach a destination service through an existing intention that was not created for them. This issue requires Connect service mesh to be enabled with active intentions. Deployments where catalog names do not contain the affected characters are not impacted in practice. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Consul 2.0.4 or Consul Enterprise 1.21.18, 1.22.12, or 2.0.4. Acknowledgement This issue was…