Bug 2560986 (CVE-2026-105765)
| Summary: | CVE-2026-105765 github.com/hashicorp/consul: Consul: Information disclosure via authorization bypass in leaf certificate API | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | lchilton, rhel-process-autobot, sfeifer, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in HashiCorp Consul. An authorization bypass vulnerability in the agent's service mesh leaf certificate API allows an attacker without a valid Access Control List (ACL) token to retrieve cached service leaf certificates along with their private keys. This could enable an unauthorized attacker to obtain sensitive cryptographic credentials and potentially impersonate trusted services within the network.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-26 17:54:03 UTC
|