CVE-2026-105765

A flaw was found in HashiCorp Consul. An authorization bypass vulnerability in the agent's service mesh leaf certificate API allows an attacker without a valid Access Control List (ACL) token to retrieve cached service leaf certificates along with their private keys. This could enable an unauthorized attacker to obtain sensitive cryptographic credentials and potentially impersonate trusted services within the network.

Red Hat has rated this vulnerability as Important because unauthenticated remote callers can bypass access controls on the agent endpoint to extract cached TLS leaf certificates and private keys. The loss of these cryptographic credentials presents a high confidentiality risk, allowing an adversary to impersonate trusted mesh endpoints. Within Red Hat Enterprise Linux, Consul is not deployed as a standalone service daemon and is only included as vendored client library code in packages like Grafana, significantly limiting the attack surface in default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce ACL token validation before returning cached leaf certificates and private keys from the agent HTTP API: upgrade to Consul Community Edition 2.1.0, Consul Enterprise 2.1.0 and 1.21.19 (or the fixed Grafana builds), which enforce ACL authorization checks before returning cached leaf certificates and private keys, closing unauthenticated HTTP request to the service mesh leaf certificate API. Until patched, this is a concern on Consul agents with Access Control Lists (ACLs) enabled and network-accessible HTTP APIs, so restrict network access to the Consul agent HTTP API or block the leaf certificate endpoint via http_config.block_endpoints. These controls limit blast radius and contain exploitation, but they do not fix the underlying authorization bypass defect — apply the upstream patch to fully remediate.