CVE-2026-87090

HashiCorp Consul and Consul Enterprise contain an incorrect-authorization flaw (CWE-863) in the catalog node-write path. An authenticated attacker holding a token with node-write permission on any single node name can delete another node's catalog registration and take over that node's identity, provided they are able to obtain the target node's node ID. Successful exploitation corrupts service catalog state, producing high integrity and availability impact (CVSS 3.1: 8.3, High). Users running affected versions of Consul or Consul Enterprise are affected, especially in multi-team or multi-tenant clusters where many node-scoped tokens exist. There is no evidence of active exploitation: the flaw is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade to Consul 2.0.4, or Consul Enterprise 1.21.18, 1.22.12, or 2.0.4. As interim mitigation, audit issued tokens for node-write rights, restrict grants to the nodes they are meant to manage, and limit disclosure of node IDs to untrusted parties. No in-the-wild exploitation or public PoC is known, but remediate promptly given the High severity rating.