{"id":"CVE-2026-115804","kind":"vulnerability","aliases":["CVE-2026-115804"],"related":[],"title":"HashiCorp Consul: authenticated users can modify other services' health checks","description":"HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.","summary":"HashiCorp Consul and Consul Enterprise have an authorization bypass in health check registration. An authenticated user can modify health checks belonging to another service on the same node.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["consul","infrastructure","kubernetes","self-hosted","service-discovery"],"not_affected_if":["no-acl-users","single-service-per-node"],"how_to_check":"- Run `consul version` on each Consul server and agent and compare against the fixed versions.\n- Check whether ACLs are enabled and which tokens can register services or checks on shared nodes (unknown if the sources do not say more).","fix":"- Upgrade Consul Community Edition to `2.1.0`.\n- Upgrade Consul Enterprise to `2.1.0` or `1.21.19`.","status":"open","published_at":"2026-10-26T18:17:37+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","triaged_at":"2026-10-26T18:34:03+00:00","updated_at":"2026-10-26T18:34:03+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T18:34:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Consul Community Edition to `2.1.0`.\n- Upgrade Consul Enterprise to `2.1.0` or `1.21.19`.","reach":"network","title":"HashiCorp Consul: authenticated users can modify other services' health checks","impact":"medium","summary":"HashiCorp Consul and Consul Enterprise have an authorization bypass in health check registration. An authenticated user can modify health checks belonging to another service on the same node.","category":"infrastructure","nicknames":[],"who_cares":["consul","self-hosted","kubernetes","service-discovery"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user alters another service's health checks on the same node.","analyst_note":"Check the HashiCorp security advisory for the exact affected version ranges and whether ACLs are required to trigger it.","how_to_check":"- Run `consul version` on each Consul server and agent and compare against the fixed versions.\n- Check whether ACLs are enabled and which tokens can register services or checks on shared nodes (unknown if the sources do not say more).","needs_analyst":true,"not_affected_if":["single-service-per-node","no-acl-users"],"who_is_affected":"Teams running Consul or Consul Enterprise where more than one service shares a node and some users or tokens are authenticated to register or modify health checks. Deployments where only trusted operators can register checks are less exposed. Single-service nodes are unlikely to matter.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000607,"input_tokens":3344,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115804':13A,16A,91C '-2026':12A,15A,90C '1.21.19':104C '2.1.0':98C,102C 'allow':71C 'anoth':48B,81C 'authent':3A,40B,73C 'author':33B,63C 'belong':46B,79C 'bypass':34B,64C 'check':10A,37B,45B,67C,78C 'communiti':96C 'consul':2A,17B,27B,29B,55C,57C,95C,100C 'cve':11A,14A,89C 'discoveri':25B 'edit':97C 'enterpris':30B,58C,101C 'fix':93C 'hashicorp':1A,26B,54C 'health':9A,36B,44B,66C,77C 'host':22B 'infrastructur':18B 'kubernet':19B 'may':70C 'modifi':6A,43B,76C 'node':53B,86C 'registr':38B,68C 'self':21B 'self-host':20B 'servic':8A,24B,49B,82C 'service-discoveri':23B 'user':4A,41B,74C 'vulner':60C,88C","nicknames":[],"mitigations":[],"who_affected":"Teams running Consul or Consul Enterprise where more than one service shares a node and some users or tokens are authenticated to register or modify health checks. Deployments where only trusted operators can register checks are less exposed. Single-service nodes are unlikely to matter.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","cvss_by":"security@hashicorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115804","severity":null,"published_at":"2026-10-26T18:17:37+00:00","modified_at":"2026-10-26T18:17:37+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","fetched_at":"2026-10-26T18:31:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}