An authorization bypass in HashiCorp Consul allows authenticated attackers to hijack node identities, posing a significant risk to cluster integrity and service security.

This vulnerability is an incorrect authorization flaw (CWE-863) within the catalog node-write path. An attacker possessing a token with node-write permissions can bypass security checks to delete existing catalog registrations and hijack the identity of other nodes if they discover the target node ID.

Successful exploitation allows an attacker to manipulate the service catalog by deleting legitimate registrations and assuming the identity of other nodes. This can lead to unauthorized interception of traffic, service disruption, and potential data compromise within the service mesh. Given the CVSS score of 8.3, this high-severity flaw requires immediate attention to prevent lateral movement or total control over node registration processes.

Immediate Action: Upgrade HashiCorp Consul and Consul Enterprise to version 2.0.4 or later as specified in the official HashiCorp security advisory.

Proactive Monitoring: Review Consul audit logs for suspicious catalog modifications or unauthorized attempts to write to node entries that deviate from standard operational patterns.

Compensating Controls: Strictly enforce the principle of least privilege for tokens, ensuring that node-write permissions are restricted to the minimum number of authorized entities necessary for cluster operations.

Public Exploit Available: No (exploit_available: false)

The ability for an authenticated attacker to hijack node identities represents a critical breakdown in the trust model of the Consul environment. Administrators should prioritize the deployment of the 2.0.4 patch across all affected clusters to remediate this authorization bypass. Failure to patch may expose the infrastructure to man-in-the-middle attacks or unauthorized service redirection.