CVE-2026-87107
No fix known EPSS <1%CVSS 5.4
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Products: HashiCorp Consul, HashiCorp Consul Enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | consul-1.22 | no fix |
| Chainguard | consul-fips-1.22 | no fix |
| Ubuntu 18.04 LTS | consul | no fix |
| Ubuntu 20.04 LTS | consul | no fix |
| Ubuntu 22.04 LTS | consul | no fix |