CVE-2026-105765
Description
A flaw was found in HashiCorp Consul. An authorization bypass vulnerability in the agent's service mesh leaf certificate API allows an attacker without a valid Access Control List (ACL) token to retrieve cached service leaf certificates along with their private keys. This could enable an unauthorized attacker to obtain sensitive cryptographic credentials and potentially impersonate trusted services within the network.
Statement
Red Hat has rated this vulnerability as Important because unauthenticated remote callers can bypass access controls on the agent endpoint to extract cached TLS leaf certificates and private keys. The loss of these cryptographic credentials presents a high confidentiality risk, allowing an adversary to impersonate trusted mesh endpoints. Within Red Hat Enterprise Linux, Consul is not deployed as a standalone service daemon and is only included as vendored client library code in packages like Grafana, significantly limiting the attack surface in default configurations.
Mitigation
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce ACL token validation before returning cached leaf certificates and private keys from the agent HTTP API: upgrade to Consul Community Edition 2.1.0, Consul Enterprise 2.1.0 and 1.21.19 (or the fixed Grafana builds), which enforce ACL authorization checks before returning cached leaf certificates and private keys, closing unauthenticated HTTP request to the service mesh leaf certificate API. Until patched, this is a concern on Consul agents with Access Control Lists (ACLs) enabled and network-accessible HTTP APIs, so restrict network access to the Consul agent HTTP API or block the leaf certificate endpoint via http_config.block_endpoints. These controls limit blast radius and contain exploitation, but they do not fix the underlying authorization bypass defect — apply the upstream patch to fully remediate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
If the cache is accessible to unauthorized actors, attackers can read the cache and obtain this sensitive information.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
