CVE-2026-87107
CVE-2026-87107 · Consul vulnerable to an authorization bypass in the catalog deregistration path
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
CVSS 5.4 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
consul
- Versions
- ≥ 1.21.0, < 2.0.4: Affected (semver)
Update to 2.0.4
consul enterprise
- Versions
- ≥ 1.21.0, < 2.0.4: Affected; ≥ 1.21.18: Not affected; ≥ 1.22.12: Not affected (semver)
Update to 1.21.18
consul Ubuntu:18.04:LTS
- Versions
- 0.6.4~dfsg-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
consul Ubuntu:20.04:LTS
- Versions
- 1.0.7~dfsg1-5ubuntu1
- 1.4.4~dfsg1-2ubuntu2
- 1.5.2+dfsg1-6
- 1.5.2+dfsg1-10
- 1.5.2+dfsg1-12
- 1.5.2+dfsg2-14
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
consul Ubuntu:22.04:LTS
- Versions
- 1.7.4+dfsg1-1
- 1.8.7+dfsg1-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published