{"id":"CVE-2026-87090","title":"Consul vulnerable to an authorization bypass in the catalog node-write path","summary":"Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker wit…","severity":"high","cvss":8.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","cvssSource":"cna","cwe":["CWE-863"],"vendor":"HashiCorp","product":"Consul","affected":["Consul >= 0.1.0 < 2.0.4","consul_enterprise >= 0.1.0 < 2.0.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T19:02:38.060194Z"},"published":"2026-09-10","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:02:58.403Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-87090","references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-34-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-node-write-path/77736"}],"tags":["cve.org"],"epss":0.00372,"epssPercentile":0.28321,"ingestedAt":"2026-09-11T16:45:48.026Z","slug":"CVE-2026-87090","body":"## Overview\n\nConsul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.\n\n## Affected\n\n- `Consul >= 0.1.0 < 2.0.4`\n- `consul_enterprise >= 0.1.0 < 2.0.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":45.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}