CVE-2026-105608 in Consul
Summary
by MITRE • 10/26/2026
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
HashiCorp Consul, a widely deployed service mesh and infrastructure orchestration platform, contains an authorization bypass vulnerability within its service mesh proxy registration mechanism. This flaw specifically affects the handling of Envoy escape-hatch configurations, which allow administrators to inject custom configuration into the underlying Envoy sidecar proxies for advanced networking scenarios. The core issue lies in the insufficient separation of privileges during the validation and application phases of these configurations. A user account possessing only service write permissions is able to submit an escape-hatch configuration that requires mesh-level administrative rights, thereby circumventing the intended access control boundaries established by the platform's role-based access control system.
The technical root cause stems from a logic error in the authorization middleware or policy evaluation engine used during proxy registration requests. When a user with limited service-scoped write privileges attempts to register or update a service mesh entry that includes custom Envoy configuration, the system fails to correctly validate whether the specific action of applying escape-hatch settings requires broader mesh-level permissions. Instead of rejecting the request due to insufficient privilege level for this specific sub-action, the system proceeds to apply the configuration. This effectively grants the user capabilities equivalent to a mesh administrator without having been granted that role, allowing them to manipulate proxy behavior in ways intended only for higher-privileged operators.
The operational impact of this vulnerability is significant within environments relying on Consul for strict service isolation and security policy enforcement. An attacker with compromised credentials or an insider threat actor possessing service write access can exploit this flaw to alter the traffic routing, load balancing, or mTLS settings of services across the entire mesh. By injecting malicious escape-hatch configurations, they could potentially disable mutual TLS encryption, redirect sensitive internal traffic to untrusted endpoints, or introduce denial-of-service conditions by misconfiguring proxy timeouts and connection limits. This undermines the integrity of the service mesh architecture, as it allows lateral movement and privilege escalation from a low-privileged service account to full control over network-level security policies for all services in the cluster.
This vulnerability aligns with CWE-269 Improper Privilege Management, specifically where an actor is able to perform actions beyond their assigned privileges due to flawed authorization logic. In terms of offensive cybersecurity frameworks, this behavior corresponds to MITRE ATT&CK technique T1078 Valid Accounts, as it involves the misuse of legitimate credentials and permissions within a system. Furthermore, the ability to modify proxy configurations without proper oversight relates to potential abuse of infrastructure components for malicious traffic manipulation, which can be categorized under techniques involving command and control channel modification or defense evasion through configuration changes.
To mitigate this risk, organizations running affected versions must immediately upgrade their Consul installations to version 2.1.0 for the Community Edition, or versions 2.1.0 and 1.21.19 for Enterprise editions. These releases contain patches that enforce strict permission checks on escape-hatch configurations, ensuring that only users with explicit mesh write permissions can apply such settings. In addition to upgrading, administrators should audit existing user roles and policies within their Consul clusters to ensure the principle of least privilege is strictly enforced. It is recommended to review all service accounts with write access to determine if they require full proxy configuration capabilities; where possible, these privileges should be restricted further until the upgrade can be implemented. Regular monitoring of authorization logs for unusual patterns in proxy registration requests can also help detect potential exploitation attempts before significant damage occurs.