CVE-2026-88021

HashiCorp Consul and Consul Enterprise contain an authorization bypass (CWE-185) in the Connect service mesh, caused by improper escaping when Consul builds Envoy RBAC rules that enforce Connect intentions. When service names, namespaces, or partitions contain certain characters, the generated authorization rules match more broadly than intended, allowing a low-privileged service in the mesh to connect to a destination its intentions do not authorize (CVSS 3.1: 7.1, network vector, low privileges required, no user interaction). An attacker who controls or compromises a registered workload can thereby reach restricted services, with high confidentiality impact and low integrity impact per the CVSS score. Only deployments using the Connect service mesh with intentions are affected; the flaw is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. There is no public proof of concept, the issue is not in CISA KEV, and no exploitation is currently known.

What to do: Upgrade to Consul 2.0.4, or Consul Enterprise 1.21.18, 1.22.12, or 2.0.4. In the meantime, review Connect intentions for services whose names, namespaces, or partitions contain special characters, inspect the Envoy RBAC rules Consul generates for over-broad matches, and audit east-west service logs for connections that should have been denied by intentions.