CVE-2026-105765: fallo de gravedad alta en HashiCorp Consul
Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.2%
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVEs relacionadas — HashiCorp Consul
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-0845MEDIUMConsul Server Panic when Ingress and API Gateways Configured with PeeringEPSS 1.0%CVE-2024-10005HIGHConsul L7 Intentions Vulnerable To URL Path BypassEPSS 0.8%CVE-2023-1297MEDIUM Consul Cluster Peering can Result in Denial of ServiceEPSS 0.8%CVE-2022-3920MEDIUMConsul Peering Imported Nodes/Services LeakEPSS 0.7%CVE-2023-2816HIGHConsul Envoy Extension Downsteam Proxy Configuration By Upstream Service OwnerEPSS 0.6%CVE-2026-15972HIGHUnauthenticated denial of service via unbounded external gRPC connection acceptanceEPSS 0.5%