high7.5
CVE-2026-105765
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may a…
Impact
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| HashiCorp | HashiCorp Consul And Consul Enterprise 1.17.0 | before 2.0.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.