33 matches found
Security Bulletin: Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
Summary HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
CVE-2026-105765
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
UBUNTU-CVE-2026-105765
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
CVE-2026-105765
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
CVE-2026-105765 Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
CVE-2026-105765
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
CVE-2026-105765 Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
EUVD-2026-110050
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
CVE-2026-105765
HashiCorp Consul and Consul Enterprise versions 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API. An attacker lacking a valid ACL token could exploit this flaw to retrieve a cached service leaf certificate and its associated private key...
Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
Summary HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent’s service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
PT-2026-125024
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
SUSE CVE-2026-71886
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in OpenPGPCertificate.getCertificationBy and getDelegationBy in the OpenPGP certificate API. An attacker can have a third-party certification or direct-key trust delegation accepted as if it were issued by the...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in OpenPGPCertificate.getCertificationBy and getDelegationBy in the OpenPGP certificate API. An attacker can have a third-party certification or direct-key trust delegation accepted as if it were issued by the...
DEBIAN-CVE-2026-71886
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify...
CVE-2026-71886
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify...
UBUNTU-CVE-2026-71886
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify...
EUVD-2026-92002
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify...
CVE-2026-71886
In Bouncy Castle for Java before version 1.86 , the high-level OpenPGP certificate API contains a flaw where it accepts third-party certifications or trust delegations from any component key of an issuing certificate without verifying if that component had the authority to certify. Specifically, ...
Linux Distros Unpatched Vulnerability : CVE-2026-71886
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of...