Live › vulnerability › CVE-2026-115804
Go to dashboardHashiCorp Consul and Consul Enterprise have an authorization bypass in health check registration. An authenticated user can modify health checks belonging to another service on the same node.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Teams running Consul or Consul Enterprise where more than one service shares a node and some users or tokens are authenticated to register or modify health checks. Deployments where only trusted operators can register checks are less exposed. Single-service nodes are unlikely to matter.
No product ranges from the sources yet.
consul version on each Consul server and agent and compare against the fixed versions.2.1.0.2.1.0 or 1.21.19.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
This page as .md · .json · in your agent: get_signal("CVE-2026-115804")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.