HashiCorp Consul auth bypass in service mesh leaf certificate API
Original title: HashiCorp security advisory (AV26-1087)
Canada’s Cyber Centre urges admins to apply HashiCorp updates for Consul and Consul Enterprise as they become available.
The Canadian Centre for Cyber Security republished HashiCorp advisory HCSEC-2026-46 (AV26-1087) on October 26, 2026. Consul before 2.1.0 and Consul Enterprise before 1.21.19 and before 2.1.0 are affected by an authorization bypass in the agent’s service mesh leaf certificate API. The centre tells users and administrators to review HashiCorp’s links and apply necessary updates. Exploitation is not mentioned.
Unconfirmed: The advisory does not state whether the bypass is being exploited.
- Serial AV26-1087 is dated October 26, 2026.
- Consul is affected prior to 2.1.0.
- Consul Enterprise is affected prior to 1.21.19 and prior to 2.1.0.
- The flaw is tracked by HashiCorp as HCSEC-2026-46.
Impact: authorization bypass in the service mesh leaf certificate API
| Product | Affected |
|---|---|
| HashiCorp Consul | Prior to 2.1.0 |
| HashiCorp Consul Enterprise | Prior to 1.21.19; prior to 2.1.0 |
- 1.Review HashiCorp’s HCSEC-2026-46 links and apply necessary updates when available.
- Vendors
- HashiCorp
- Products
- ConsulConsul Enterprise
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-1087 Date: October 26, 2026 As of October 26, 2026, HashiCorp is affected by a vulnerability in the following products: Consul Prior to 2. 1. 0 Consul Enterprise Prior to 1.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.