CVE-2026-87090
No fix known EPSS <1%CVSS 8.3
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Products: HashiCorp Consul, HashiCorp Consul Enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | consul-1.22 | no fix |
| Chainguard | consul-fips-1.22 | no fix |
| Ubuntu 18.04 LTS | consul | no fix |
| Ubuntu 20.04 LTS | consul | no fix |
| Ubuntu 22.04 LTS | consul | no fix |