CVE-2026-87090: hashicorp consul Incorrect Authorization
Vulnerability summary
CVE-2026-87090 is a high (CVSS 8.3) Incorrect Authorization vulnerability in hashicorp consul. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.6% of scored vulnerabilities.
Timeline
- 10-09-2026PublishedVulnerability first disclosed.
- 10-09-2026Last modifiedVulnerability information updated.
Description
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
- NVDNIST8.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
+0.17 pp
From 0.21% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- consul-1.22All versions (No fix recorded)
- consul-fips-1.22All versions (No fix recorded)
Hashicorp2 products
- consul≥ 0.1.0, < 2.0.4
- consul enterprise≥ 0.1.0, < 2.0.4
Ubuntu1 product
- consulAll versions (No fix recorded)
3 vendors · 5 products
References
6 links
- github.com/hashicorp/consulPACKAGE