CVE-2026-87106 in Consul
Summary
by MITRE • 09/10/2026
Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
The identified vulnerability within HashiCorp Consul and Consul Enterprise represents a critical denial of service flaw located in the native RPC listener mechanism. This issue stems from an improper sequence of operations during the authentication and authorization lifecycle, specifically allowing for resource exhaustion prior to security validation. The core technical flaw involves the server allocating significant memory resources to handle incoming connections and process internal Remote Procedure Call (RPC) requests before verifying whether the connecting client possesses valid Access Control List tokens or permissions. This architectural oversight creates a window of opportunity where an attacker can trigger substantial memory consumption on the Consul agent without first proving their identity or authorization status, effectively bypassing the intended security gates that should filter out unauthorized traffic at an earlier stage in the connection handling process.
From an operational perspective, this vulnerability allows any client capable of completing the mutual Transport Layer Security handshake to initiate a denial of service attack against the Consul server. The attacker does not need to hold a valid ACL token or possess legitimate credentials for specific resources within the datacenter. By establishing the mTLS handshake, which verifies the identity of both parties based on certificates, an authenticated client can then proceed to send requests that consume excessive memory on the server side. Since this resource allocation occurs before the system checks if the user has permission to perform these actions, even a low-privileged or unauthorized account with valid TLS credentials can exhaust available server memory. This leads to service degradation or complete unavailability of Consul services for legitimate users who rely on the platform for service discovery, configuration management, and orchestration coordination within their infrastructure.
The security implications are severe as they undermine the principle of least privilege by allowing resource exhaustion attacks from authenticated but unauthorized actors. In a typical deployment where ACLs are enabled to restrict access based on tokens, this flaw effectively neutralizes that protection against denial of service vectors targeting memory resources. Attackers can leverage automated scripts to open numerous connections or send large payloads through the RPC interface, rapidly depleting server RAM and causing crashes or restarts. This impacts the availability of critical infrastructure services managed by Consul, potentially leading to cascading failures in dependent applications that rely on real-time health checks and service registration data provided by the platform.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, as well as CWE-787, regarding out-of-bounds write scenarios if memory corruption occurs during exhaustion attempts. In terms of adversarial tactics, this exploit maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-category of Resource Exhaustion: Overflow. It also relates to T1078, Valid Accounts, as it requires initial authentication via mTLS but exploits a flaw in how authorization is applied post-authentication for resource-intensive operations. The attack vector is network-based and requires local or remote access depending on deployment topology, with the primary requirement being valid TLS certificates issued by the Consul CA.
To mitigate this risk, organizations must immediately upgrade to patched versions of HashiCorp Consul and Consul Enterprise. Specifically, users should migrate to Consul version 2.0.4 for both open-source and enterprise editions. For those running older supported lines, upgrading to Consul Enterprise 1.21.18 or 1.22.12 is required. Until patches are applied, administrators can implement network-level controls such as rate limiting on the RPC port to restrict the number of concurrent connections from any single source IP address. Additionally, configuring firewall rules to limit access to the Consul RPC listener only to known, trusted application servers and management nodes reduces the attack surface by preventing unauthorized hosts from initiating mTLS handshakes in the first place. Monitoring memory usage patterns on Consul agents can also help detect potential exploitation attempts early, allowing for rapid incident response before total service failure occurs.