CVE-2026-87107

MediumCVSS 5.4/10Last modified Sep 10, 2026

Description

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
HashiCorp	Consul	>= 1.21.0, < 2.0.4
HashiCorp	Consul Enterprise	>= 1.21.0, < 2.0.4

References

https://discuss.hashicorp.com/t/hcsec-2026-36-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-deregistration-path/77738

Timeline

Published: Sep 10, 2026
Last modified: Sep 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-871084.3An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different proj CVE-2026-871096.5An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing en CVE-2026-87119.8NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for CVE-2026-871105.3An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work CVE-2026-871117.2The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to St CVE-2026-871128.8The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 vi CVE-2026-871136.3Tanium addressed an improper access controls vulnerability in Threat Response.CVE-2026-871147.1A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container imag CVE-2026-871159.1The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path va CVE-2026-871166.5Tanium addressed a server-side request forgery vulnerability in Threat Response.CVE-2026-871178.7NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recom CVE-2026-871185.7The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticat