CVE-2026-115804

A flaw was found in Consul. An authenticated user can bypass authorization controls during health check registration to modify health checks belonging to another service running on the same node. This improper access control may allow an attacker to alter service health statuses, potentially leading to unauthorized service disruption or improper traffic routing.

This vulnerability is assessed with a Moderate severity impact because successful exploitation demands valid authentication and permissions to register checks on the local host. The blast radius is limited to altering health monitor statuses and traffic routing for adjacent services on the same node, without permitting arbitrary code execution or confidentiality loss. Furthermore, Red Hat products bundling Consul client libraries do not deploy or expose the vulnerable agent-side service registration endpoints by default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to a fixed consul version (fixed in Consul CE 2.1.0 and Enterprise 2.1.0/1.21.19). As a workaround, restrict ACL service:write permissions so only trusted principals can register health checks, particularly on shared nodes.