{"id":"CVE-2026-105626","kind":"vulnerability","aliases":["CVE-2026-105626"],"related":[],"title":"HashiCorp Consul: unauthenticated HTTP API flaw exhausts agent memory","description":"HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.","summary":"HashiCorp Consul and Consul Enterprise have a denial-of-service flaw in the HTTP API. An unauthenticated attacker can exhaust memory on a Consul agent, crashing it or degrading service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["consul","infrastructure","kubernetes","self-hosted"],"not_affected_if":["fixed-version"],"how_to_check":"- Run `consul version` on each Consul agent and compare against the fixed versions listed in Fix.\n- Confirm whether the HTTP API is reachable from untrusted networks, for example with `consul members` from outside the cluster network or by checking the bind address in the agent configuration.","fix":"- Consul Community Edition: upgrade to `2.1.0`.\n- Consul Enterprise: upgrade to `2.1.0` or `1.21.19`.","status":"open","published_at":"2026-10-26T18:17:27+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","triaged_at":"2026-10-26T18:33:51+00:00","updated_at":"2026-10-26T18:33:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T18:33:51Z","model":"claude-haiku-5-5","output":{"fix":"- Consul Community Edition: upgrade to `2.1.0`.\n- Consul Enterprise: upgrade to `2.1.0` or `1.21.19`.","reach":"network","title":"HashiCorp Consul: unauthenticated HTTP API flaw exhausts agent memory","impact":"medium","summary":"HashiCorp Consul and Consul Enterprise have a denial-of-service flaw in the HTTP API. An unauthenticated attacker can exhaust memory on a Consul agent, crashing it or degrading service.","category":"infrastructure","nicknames":[],"who_cares":["consul","self-hosted","kubernetes"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker exhausts agent memory, crashing the Consul agent","analyst_note":"Confirm the affected version range and whether the HTTP API is exposed by default; check the HashiCorp advisory linked from NVD.","how_to_check":"- Run `consul version` on each Consul agent and compare against the fixed versions listed in Fix.\n- Confirm whether the HTTP API is reachable from untrusted networks, for example with `consul members` from outside the cluster network or by checking the bind address in the agent configuration.","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Any team running Consul or Consul Enterprise agents whose HTTP API is reachable by an attacker. Exposure depends on network reachability of the HTTP API; the sources do not describe a configuration that avoids it. Teams on fixed versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000628,"input_tokens":3349,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105626':12A,15A,86C '-2026':11A,14A,85C '1.21.19':99C '2.1.0':93C,97C 'agent':8A,47B,81C 'allow':71C 'api':5A,37B,68C 'attack':40B,74C 'communiti':91C 'consul':2A,16B,23B,25B,46B,54C,56C,80C,90C,95C 'crash':48B 'cve':10A,13A,84C 'degrad':51B 'denial':30B,62C 'denial-of-servic':29B 'edit':92C 'enterpris':26B,57C,96C 'exhaust':7A,42B,76C 'fix':88C 'flaw':6A,33B 'hashicorp':1A,22B,53C 'host':21B 'http':4A,36B,67C 'infrastructur':17B 'kubernet':18B 'may':70C 'memori':9A,43B,77C 'self':20B 'self-host':19B 'servic':32B,52B,64C 'unauthent':3A,39B,73C 'vulner':59C,83C","nicknames":[],"mitigations":[],"who_affected":"Any team running Consul or Consul Enterprise agents whose HTTP API is reachable by an attacker. Exposure depends on network reachability of the HTTP API; the sources do not describe a configuration that avoids it. Teams on fixed versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@hashicorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105626","severity":null,"published_at":"2026-10-26T18:17:27+00:00","modified_at":"2026-10-26T18:17:27+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","fetched_at":"2026-10-26T18:31:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}