CVE-2026-87090 Consul vulnerable to an authorization bypass in the catalog node-write path
Authenticated attackers can bypass authorization to delete other nodes' catalog registrations and take over their identities in Consul.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-87090?
CVE-2026-87090 is a high-severity authentication bypass vulnerability in HashiCorp Consul, published on 10 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Weakness: CWE-863
Which versions are affected by CVE-2026-87090?
1 open source package ship an affected version, including consul.
| Package | Affected | Fixed in |
|---|---|---|
consul Bitnami | From 0.1.0 | 2.0.4 |
How do I fix CVE-2026-87090?
Upgrade consul to 2.0.4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-87090 being exploited?
There is no known exploitation of CVE-2026-87090 in the wild and no public exploit code.
Sources
Also known as BIT-consul-2026-87090, GHSA-mjp7-4wvg-9f57, MINI-vh9w-c9v6-44wm, MINI-xwvf-m439-62xc, UBUNTU-CVE-2026-87090.