HCSEC-2026-47 - Consul vulnerable to an authorization bypass in service mesh registration
// AI summary
HashiCorp Consul 2.0.4, 1.22.12, and Consul Enterprise 2.0.4, 1.21.18 are vulnerable to an authorization bypass allowing service write users to apply Envoy escape-hatch configuration.
// from the source
Bulletin ID: HCSEC-2026-47 Affected Products / Versions: Consul 2.0.4 and Consul Enterprise 2.0.4, 1.22.12 and 1.21.18; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (