Full Report
HashiCorp security advisory (AV26-910)
Analysis Summary
# Vulnerability: Multiple Security Flaws in HashiCorp Consul and Consul-Template
## CVE Details
*Note: Specific CVE IDs were not explicitly listed in the source advisory text provided; however, based on HashiCorp's internal advisory IDs (HCSEC), the following is categorized:*
* **HCSEC-2026-34**: Authorization Bypass (Catalog node-write)
* **HCSEC-2026-37**: Authorization Bypass (Connect service mesh)
* **HCSEC-2026-38**: Information Disclosure (Error handling)
* **CVSS Score**: Not explicitly stated (Typically High for Authorization Bypass, Low-Medium for Information Disclosure)
* **CWE**: CWE-285 (Improper Authorization), CWE-209 (Generation of Error Message Containing Sensitive Information)
## Affected Systems
* **Products**: HashiCorp Consul, Consul Enterprise, and Consul-Template.
* **Versions**:
* **Consul (OSS)**: Prior to 2.0.4
* **Consul Enterprise**: 1.0, 21.0, and 9.0 (Prior to 1.21.18)
* **Consul-template**: Prior to 0.43.0
* **Configurations**:
* Systems utilizing the Catalog API for node registration.
* Deployments using Consul Connect service mesh.
* Consul-template instances handling sensitive error logs.
## Vulnerability Description
1. **Authorization Bypass (Catalog node-write):** A flaw in the catalog node-write path allows an attacker to bypass intended authorization checks, potentially leading to unauthorized modification of node metadata or registration status.
2. **Authorization Bypass (Connect service mesh):** A vulnerability in the Connect service mesh component could allow unauthorized services to communicate within the mesh or bypass security intentions.
3. **Information Disclosure (Consul-template):** The application may disclose sensitive information through verbose or improperly handled error messages, which could assist an attacker in further exploitation.
## Exploitation
* **Status**: Not exploited (No reports of active exploitation in the wild at the time of the advisory).
* **Complexity**: Medium (Requires specific knowledge of the Consul API and internal mesh architecture).
* **Attack Vector**: Network (Remote access to the Consul API or service mesh is required).
## Impact
* **Confidentiality**: Moderate (Information disclosure via templates).
* **Integrity**: High (Unauthorized modification of service registry and service mesh configurations).
* **Availability**: Moderate (Potential for service disruption via unauthorized registry changes).
## Remediation
### Patches
HashiCorp recommends upgrading to the following versions immediately:
* **Consul**: Update to version **2.0.4** or later.
* **Consul Enterprise**: Update to version **1.21.18** (across all affected branches 1.0, 9.0, 21.0).
* **Consul-template**: Update to version **0.43.0** or later.
### Workarounds
* **ACL Enforcement**: Ensure Access Control Lists (ACLs) are strictly configured following the principle of least privilege.
* **Network Segmentation**: Restrict access to the Consul HTTP API and RPC ports to trusted administrative hosts only.
* **Log Sanitization**: For consul-template, review error logging configurations to ensure sensitive data is not being captured in external logging aggregators.
## Detection
* **Indicators of Compromise**:
* Unusual `node-write` activity in Consul audit logs from unexpected tokens.
* Unauthorized service registration entries in the Consul UI/API.
* **Detection methods**: Monitor HashiCorp Consul audit logs for `403 Forbidden` errors followed by successful writes from the same source, which may indicate trial-and-error bypass attempts.
## References
* [HCSEC-2026-34] hxxps[://]discuss[.]hashicorp[.]com/t/hcsec-2026-34-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-node-write-path/77736
* [HCSEC-2026-37] hxxps[://]discuss[.]hashicorp[.]com/t/hcsec-2026-37-consul-vulnerable-to-an-authorization-bypass-in-the-connect-service-mesh/77739
* [HCSEC-2026-38] hxxps[://]discuss[.]hashicorp[.]com/t/hcsec-2026-38-consul-template-vulnerable-to-an-information-disclosure-issue-in-error-handling/77740
* [HashiCorp Security Discuss] hxxps[://]discuss[.]hashicorp[.]com/c/security/52