HCSEC-2026-47 - Consul vulnerable to an authorization bypass in service mesh registration

Bulletin ID: HCSEC-2026-47 Affected Products / Versions: Consul 2.0.4 and Consul Enterprise 2.0.4, 1.22.12 and 1.21.18; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Background Consul service mesh supports Envoy escape-hatch overrides, which let operators supply raw Envoy configuration in a proxy’s service registration to replace configuration that Consul would otherwise generate. Because these overrides can change how the sidecar proxy handles traffic, Consul requires the mesh write permission, in addition to service write, to register a proxy that sets them. Details Consul’s permission check identified escape-hatch overrides by key name, but recognized fewer key spellings than the configuration processing that later applies them. As a result, a crafted proxy registration could supply an override using an equivalent key spelling that the check did not recognize but Consul still applied. An authenticated user with service write permission on a proxy and its destination service, but without mesh write, could inject arbitrary Envoy configuration into that sidecar proxy. This could potentially allow code execution within the proxy, access to or modification of the traffic it handles, or bypass of intention enforcement at that proxy. This issue only affects deployments with ACLs enabled in which principals hold service write permission without mesh write. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Consul Community Edition 2.1.0 or Consul Enterprise 2.1.0 or 1.21.19. Acknowledgement T…