{"id":"CVE-2026-105608","kind":"vulnerability","aliases":["CVE-2026-105608"],"related":[],"title":"HashiCorp Consul: service write permission bypasses mesh write check","description":"HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.","summary":"Consul and Consul Enterprise let a user with service write permission apply Envoy escape-hatch proxy configuration without the mesh write permission that should be required. An attacker with limited service-level access can change how service mesh proxies are configured.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["consul","infrastructure","kubernetes","self-hosted","service-mesh"],"not_affected_if":["no-service-mesh"],"how_to_check":"- Check the Consul version with `consul version` and compare it against the fixed releases listed in the fix field.\n- Review which accounts or tokens hold service write permission in Consul ACLs and whether they also hold mesh write permission.\n- unknown whether the sources give a configuration check beyond the version.","fix":"- Upgrade Consul Community Edition to `2.1.0`.\n- Upgrade Consul Enterprise to `2.1.0` or `1.21.19`, depending on the release line in use.","status":"open","published_at":"2026-10-26T18:17:26+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","triaged_at":"2026-10-26T18:33:40+00:00","updated_at":"2026-10-26T18:33:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T18:33:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Consul Community Edition to `2.1.0`.\n- Upgrade Consul Enterprise to `2.1.0` or `1.21.19`, depending on the release line in use.","reach":"network","title":"HashiCorp Consul: service write permission bypasses mesh write check","impact":"medium","summary":"Consul and Consul Enterprise let a user with service write permission apply Envoy escape-hatch proxy configuration without the mesh write permission that should be required. An attacker with limited service-level access can change how service mesh proxies are configured.","category":"infrastructure","nicknames":[],"who_cares":["consul","service-mesh","self-hosted","kubernetes"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privilege user alters Envoy proxy configuration for mesh services","analyst_note":"Confirm the exact affected version ranges and whether a default configuration is exposed; check the NVD and HashiCorp advisory pages.","how_to_check":"- Check the Consul version with `consul version` and compare it against the fixed releases listed in the fix field.\n- Review which accounts or tokens hold service write permission in Consul ACLs and whether they also hold mesh write permission.\n- unknown whether the sources give a configuration check beyond the version.","needs_analyst":true,"not_affected_if":["no-service-mesh"],"who_is_affected":"Teams running Consul or Consul Enterprise with service mesh enabled, where some users or tokens hold service write permission. Deployments without service mesh proxy registration, or where only fully trusted operators can write services, face less risk. unknown whether the sources name a specific default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000642,"input_tokens":3362,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105608':12A,15A,110C '-2026':11A,14A,109C '1.21.19':123C '2.1.0':117C,121C 'access':59B 'allow':86C 'appli':36B,94C 'attack':53B 'author':77C 'bypass':6A,78C 'chang':61B 'check':9A 'communiti':115C 'configur':42B,67B,99C 'consul':2A,16B,25B,27B,69C,71C,114C,119C 'cve':10A,13A,108C 'edit':116C 'enterpris':28B,72C,120C 'envoy':37B,95C 'escap':39B,97C 'escape-hatch':38B,96C 'fix':112C 'hashicorp':1A,68C 'hatch':40B,98C 'host':21B 'infrastructur':17B 'kubernet':18B 'let':29B 'level':58B 'limit':55B 'may':85C 'mesh':7A,24B,45B,64B,81C,103C 'permiss':5A,35B,47B,92C,105C 'proxi':41B,65B,82C 'registr':83C 'requir':51B,102C 'self':20B 'self-host':19B 'servic':3A,23B,33B,57B,63B,80C,90C 'service-level':56B 'service-mesh':22B 'user':31B,88C 'vulner':74C,107C 'without':43B,100C 'write':4A,8A,34B,46B,91C,104C","nicknames":[],"mitigations":[],"who_affected":"Teams running Consul or Consul Enterprise with service mesh enabled, where some users or tokens hold service write permission. Deployments without service mesh proxy registration, or where only fully trusted operators can write services, face less risk. unknown whether the sources name a specific default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@hashicorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105608","severity":null,"published_at":"2026-10-26T18:17:26+00:00","modified_at":"2026-10-26T18:17:26+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","fetched_at":"2026-10-26T18:31:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}