Is CVE-2026-105765 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-105765?

CVE-2026-105765 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-105765

Description

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.