CVE-2026-88021 in Consul
Summary
by MITRE • 09/10/2026
Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The identified vulnerability represents a critical authorization bypass within the HashiCorp Consul Connect service mesh architecture, specifically affecting the enforcement of Role-Based Access Control (RBAC) policies through Envoy proxy configurations. This flaw arises from an improper input validation mechanism during the generation of RBAC rules intended to enforce Connect intentions between services. When administrators define access control policies based on specific service names, namespaces, or partitions, Consul fails to correctly escape special characters embedded within these identifiers. Consequently, the resulting authorization rules generated for Envoy become overly permissive, matching a broader set of requests than originally intended by the security policy configuration. This technical deficiency allows services that should be explicitly denied access to reach and communicate with destination resources they are not authorized to interact with, effectively nullifying the granular control provided by the service mesh's zero-trust model.
From an operational perspective, this vulnerability undermines the fundamental principle of least privilege within a microservices environment. In a typical Consul Connect deployment, services rely on explicit intentions to define which other services can initiate connections. When these intentions are compromised due to character escaping errors, attackers or malicious insider threats could exploit the misconfigured rules to perform lateral movement across the network. For instance, if a service name contains characters such as asterisks or question marks that are not properly escaped, they may be interpreted by Envoy as wildcard patterns rather than literal strings. This allows unauthorized services to impersonate legitimate ones or access sensitive backend APIs and databases that were intended to remain isolated from certain segments of the infrastructure. The impact is particularly severe in multi-tenant environments where strict isolation between namespaces or partitions is required for compliance with regulatory standards such as PCI-DSS or HIPAA, as the breach could lead to unauthorized data exfiltration or disruption of critical business functions.
The technical root cause aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-94 Improper Control of Generation of Code which is often categorized under injection flaws when applied to configuration generation contexts. Furthermore, this vulnerability facilitates unauthorized access that maps directly to the MITRE ATT&CK technique T1078 Valid Accounts or more specifically T1530 Data from Cloud Storage Object if used for exfiltration, but primarily it represents a failure in Access Control (T1528) and Privilege Escalation within the service mesh layer. The lack of proper sanitization allows an attacker to manipulate the intent matching logic, effectively bypassing authentication checks that rely on precise identity verification through mTLS certificates tied to specific service identities. This creates a scenario where the security boundary defined by Consul intentions is porous, allowing traffic flows that should be blocked at the proxy level to succeed.
To mitigate this risk, organizations must immediately upgrade their Consul and Consul Enterprise installations to versions 2.0.4 for both editions, as well as version 1.21.18 or later for the 1.21 branch and version 1.22.12 or later for the 1.22 branch. Prior to upgrading, it is advisable to audit existing Connect intentions for any service names, namespaces, or partitions that contain special characters such as asterisks, question marks, slashes, or other regex metacharacters. If immediate patching is not feasible due to operational constraints, administrators should consider implementing network-level segmentation using firewalls or cloud security groups to restrict traffic between services until the underlying vulnerability is resolved. Additionally, enhancing monitoring and logging for Envoy proxy access logs can help detect anomalous connection attempts that deviate from established baseline behavior, providing an additional layer of defense in depth against exploitation of this authorization bypass flaw.