CVE-2026-87090

Name of the Vulnerable Software and Affected Versions Consul versions prior to 2.0.4 Consul Enterprise versions prior to 1.21.18 Consul Enterprise versions prior to 1.22.12 Consul Enterprise versions prior to 2.0.4

Description An authorization bypass exists in the catalog node-write path. An authenticated attacker possessing a token with node-write permission for any single node name can delete the catalog registration of another node and assume its identity, provided they can obtain the node ID of a node they do not control.

Recommendations Update Consul to version 2.0.4. Update Consul Enterprise to version 1.21.18. Update Consul Enterprise to version 1.22.12. Update Consul Enterprise to version 2.0.4.