HashiCorp Patches Consul Flaw That Exposes TLS Certificates
CVE-2026-105765, rated 7.5 on CVSS 3.1, lets attackers without a valid ACL token retrieve service certificates and private keys from affected servers.
HashiCorp published security advisory HCSEC-2026-46 on October 26 covering CVE-2026-105765, an access-control bypass in Consul and Consul Enterprise, according to dailysecu.com. The company also released patched versions of both products.
The vulnerability carries a CVSS 3.1 score of 7.5 and affects Consul and Consul Enterprise versions 1.17.0 through 2.0.4.
The flaw sits in the feature that issues certificates for encrypted service-to-service communication, which fails to properly check access permissions. Under certain conditions, an attacker without a valid ACL token can retrieve service certificates and private keys stored on the server.
Fixed releases
HashiCorp has shipped Consul Community 2.1.0, along with Consul Enterprise 2.1.0 and Consul Enterprise 1.21.19.
Operators running versions in the affected range should move to one of the fixed releases.
Quick answers
Which Consul versions are affected by CVE-2026-105765?
Consul and Consul Enterprise versions 1.17.0 through 2.0.4 are affected.
What versions fix the vulnerability?
HashiCorp released Consul Community 2.1.0, plus Consul Enterprise 2.1.0 and 1.21.19.
How severe is CVE-2026-105765?
It is rated 7.5 on the CVSS 3.1 scale.