CVE-2026-87107: Consul Authorization Bypass in Catalog Deregistration Path
Summary
CVE-2026-87107: Consul vulnerable to an authorization bypass in the catalog deregistration path. Affects consul versions >= 1.21.0, < 2.0.4. Fixed in 2.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Consul is a widely used tool for service discovery and configuration management, enabling applications to discover and connect to services across dynamic infrastructures. It provides features such as health checking, service segmentation, and multi-datacenter support. However, it is vulnerable to an authorization bypass issue that affects its catalog deregistration functionality, potentially compromising the integrity of service management in peered clusters.
Vulnerability Detail
The vulnerability identified as CVE-2026-87107 allows a local ACL token with service:write or node:write permissions to delete peer-imported catalog objects without proper authorization. This means that an attacker could exploit this flaw to remove services, checks, or nodes that were imported from a peered cluster, leading to potential service disruptions and unauthorized changes in the system. The vulnerability arises from insufficient access control checks in the deregistration process.
How To Fix
Minimum fixed version
2.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the catalog deregistration functionality by limiting the permissions associated with local ACL tokens, ensuring that only trusted tokens can perform write operations on services and nodes.
Conclusion
CVE-2026-87107 represents a significant security risk for users of Consul, allowing unauthorized access to critical service management functions. It is crucial for users to update to the latest patched versions to mitigate this vulnerability and ensure the integrity of their service discovery and management processes.
See every vulnerability recorded for consul →
FAQ
CVE-2026-87107 is a vulnerability in Consul that allows unauthorized deletion of peer-imported catalog objects due to an authorization bypass in the catalog deregistration path.
If you are using Consul versions between 1.21.0 and 2.0.3, your installation is vulnerable. You can check your version using the command consul version.
The vulnerability can lead to unauthorized removal of services, checks, or nodes, potentially disrupting service availability and integrity in a peered cluster environment.
You can update your Consul installation by using the appropriate package management commands or Helm charts, depending on your deployment method. Ensure to upgrade to at least version 2.0.4.
Yes, Vulert can monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by visiting the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for consul.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
