CVE-2026-115804
Description
A flaw was found in Consul. An authenticated user can bypass authorization controls during health check registration to modify health checks belonging to another service running on the same node. This improper access control may allow an attacker to alter service health statuses, potentially leading to unauthorized service disruption or improper traffic routing.
Statement
This vulnerability is assessed with a Moderate severity impact because successful exploitation demands valid authentication and permissions to register checks on the local host. The blast radius is limited to altering health monitor statuses and traffic routing for adjacent services on the same node, without permitting arbitrary code execution or confidentiality loss. Furthermore, Red Hat products bundling Consul client libraries do not deploy or expose the vulnerable agent-side service registration endpoints by default.
Mitigation
Upgrade to a fixed consul version (fixed in Consul CE 2.1.0 and Enterprise 2.1.0/1.21.19). As a workaround, restrict ACL service:write permissions so only trusted principals can register health checks, particularly on shared nodes.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.4 | N/A | 6.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Acknowledgements
Upstream acknowledges Immad Sahin (ZeroTrail) as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
