HashiCorp security advisory (AV26-910)
Canada's Cyber Centre warns HashiCorp Consul and consul-template have authorization bypass and information disclosure flaws, urging users to apply available updates.
Advisory AV26-910 relays HashiCorp security advisories HCSEC-2026-34, HCSEC-2026-37 and HCSEC-2026-38 covering Consul and consul-template. Consul has an authorization bypass in the catalog node-write path and another in the Connect service mesh, while consul-template has an information disclosure issue in error handling. Fixed versions include Consul 2.0.4, Consul Enterprise 1.21.18 and consul-template 0.43.0. The Cyber Centre encourages users and administrators to review the linked advisories and apply updates.
- Consul affected by two authorization bypasses: catalog node-write path and Connect service mesh.
- consul-template information disclosure flaw stems from error handling before version 0.43.0.
- Fixed releases include Consul 2.0.4, Consul Enterprise 1.21.18 and consul-template 0.43.0.
- Vendors
- HashiCorp
- Organizations
- Canadian Centre for Cyber Security
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-910 Date: September 11, 2026 As of September 10, 2026, HashiCorp is affected by vulnerabilities in the following products: Consul Prior to 2. 0. 4 Consul Enterprise 1.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.