CVE-2026-88021: high-severity vulnerability in HashiCorp Consul
Consul vulnerable to an authorization bypass in the Connect service mesh
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.3%
Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Related CVEs — HashiCorp Consul
In the same product, most dangerous first.
CVE-2023-0845MEDIUMConsul Server Panic when Ingress and API Gateways Configured with PeeringEPSS 1.0%CVE-2024-10005HIGHConsul L7 Intentions Vulnerable To URL Path BypassEPSS 0.8%CVE-2023-1297MEDIUM Consul Cluster Peering can Result in Denial of ServiceEPSS 0.8%CVE-2022-3920MEDIUMConsul Peering Imported Nodes/Services LeakEPSS 0.7%CVE-2023-2816HIGHConsul Envoy Extension Downsteam Proxy Configuration By Upstream Service OwnerEPSS 0.6%CVE-2026-15972HIGHUnauthenticated denial of service via unbounded external gRPC connection acceptanceEPSS 0.5%