---
id: "CVE-2026-105765"
kind: "vulnerability"
aliases: ["CVE-2026-105765"]
title: "HashiCorp Consul: authorization bypass exposes service mesh leaf certificates and private keys"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["consul", "infrastructure", "kubernetes", "self-hosted", "service-mesh"]
not_affected_if: ["versions-outside-range"]
published_at: "2026-10-26T18:17:28+00:00"
first_seen_at: "2026-10-26T18:31:43+00:00"
updated_at: "2026-10-26T18:33:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105765", "first_seen_at": "2026-10-26T18:31:43+00:00"}]
---

# HashiCorp Consul: authorization bypass exposes service mesh leaf certificates and private keys

Consul versions 1.17.0 through 2.0.4 have an authorization bypass in the agent's service mesh leaf certificate API. An attacker without a valid ACL token can retrieve a cached service leaf certificate and its private key.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `consul version` on each agent and server and compare against the fixed versions.
- Check whether the agent's leaf certificate API is reachable without an ACL token (unknown from the sources).

## Fix

- Upgrade Consul Community Edition to `2.1.0`.
- Upgrade Consul Enterprise to `2.1.0`, or `1.21.19` on the 1.x line.

## Timeline

- 2026-10-26T18:31:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105765

## From the sources

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_