{"api_version":"1","generated_at":"2026-10-27T01:14:57+00:00","cve":"CVE-2026-115804","urls":{"html":"https://cve.report/CVE-2026-115804","api":"https://cve.report/api/cve/CVE-2026-115804.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-115804","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-115804"},"summary":{"title":"Consul vulnerable to an authorization bypass in health check registration","description":"HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.","state":"PUBLISHED","assigner":"HashiCorp","published_at":"2026-10-26 18:17:37","updated_at":"2026-10-26 20:17:51"},"problem_types":["CWE-639","CWE-639 CWE-639: Authorization Bypass Through User-Controlled Key"],"metrics":[{"version":"3.1","source":"security@hashicorp.com","type":"Secondary","score":"6.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","data":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","version":"3.1"}}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-49-consul-vulnerable-to-an-authorization-bypass-in-health-check-registration/77914","name":"https://discuss.hashicorp.com/t/hcsec-2026-49-consul-vulnerable-to-an-authorization-bypass-in-health-check-registration/77914","refsource":"security@hashicorp.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115804","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115804","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"HashiCorp","product":"Consul","version":"affected 0.7.2 2.1.0 semver","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"]},{"source":"CNA","vendor":"HashiCorp","product":"Consul Enterprise","version":"affected 0.7.2 2.1.0 semver","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"This issue was reported to HashiCorp by Immad Sahin of ZeroTrail.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-115804","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-26T18:53:55.561242Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-26T19:38:28.416Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Consul","repo":"https://github.com/hashicorp/consul","vendor":"HashiCorp","versions":[{"lessThan":"2.1.0","status":"affected","version":"0.7.2","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Consul Enterprise","repo":"https://github.com/hashicorp/consul","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.21.19","status":"unaffected"}],"lessThan":"2.1.0","status":"affected","version":"0.7.2","versionType":"semver"}]}],"credits":[{"lang":"en","value":"This issue was reported to HashiCorp by Immad Sahin of ZeroTrail."}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.</p><br/>"}],"value":"HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19."}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs"}]}],"metrics":[{"cvssV3_1":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","description":"CWE-639: Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-26T18:09:52.286Z","orgId":"67fedba0-ff2e-4543-ba5b-aa93e87718cc","shortName":"HashiCorp"},"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-49-consul-vulnerable-to-an-authorization-bypass-in-health-check-registration/77914"}],"source":{"advisory":"HCSEC-2026-49","discovery":"EXTERNAL"},"title":"Consul vulnerable to an authorization bypass in health check registration"}},"cveMetadata":{"assignerOrgId":"67fedba0-ff2e-4543-ba5b-aa93e87718cc","assignerShortName":"HashiCorp","cveId":"CVE-2026-115804","datePublished":"2026-10-26T18:09:52.286Z","dateReserved":"2026-10-23T15:53:43.970Z","dateUpdated":"2026-10-26T19:38:28.416Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-26 18:17:37","lastModifiedDate":"2026-10-26 20:17:51","problem_types":["CWE-639","CWE-639 CWE-639: Authorization Bypass Through User-Controlled Key"],"metrics":{"cvssMetricV31":[{"source":"security@hashicorp.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-26T18:53:55.561242Z","id":"CVE-2026-115804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"115804","Ordinal":"1","Title":"Consul vulnerable to an authorization bypass in health check reg","CVE":"CVE-2026-115804","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"115804","Ordinal":"1","NoteData":"HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.","Type":"Description","Title":"Consul vulnerable to an authorization bypass in health check reg"}]}}}