HashiCorp security advisory (AV26-910)
Brief
Serial Number: AV26-910
Date: September 11, 2026
As of September 10, 2026, HashiCorp is affected by vulnerabilities in the following products:
- Consul
- Prior to 2.0.4
- Consul Enterprise
- 1.0 Prior to 1.21.18
- 21.0 Prior to 1.21.18
- 9.0 Prior to 1.21.18
- consul-template
- Prior to 0.43.0
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
- HCSEC-2026-34 - Consul vulnerable to an authorization bypass in the catalog node-write path
- HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling
- HCSEC-2026-37 - Consul vulnerable to an authorization bypass in the Connect service mesh
- Security - HashiCorp Discuss
HashiCorp security advisory (AV26-910) - Canadian Centre for Cyber Security