HashiCorp Consul and Consul Enterprise versions 1.17.0 through 2.0.4 contain an authorization bypass in the agent's Service Mesh leaf certificate API. An attacker without a valid ACL token can use the exposed endpoint to retrieve a cached service leaf certificate and its private key. The disclosure of these cryptographic credentials can compromise confidentiality and integrity of the Consul service mesh.

Vulnerable builds include HashiCorp Consul Community Edition and Consul Enterprise. All releases starting with version 1.17.0 up to and including 2.0.4 are affected. The fix is delivered in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

The CVSS score of 7.5 classifies this vulnerability as high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits. The likely attack vector is via the exposed Service Mesh leaf certificate API. An attacker who can reach the API endpoint bypasses ACL checks and obtains the private key of a service leaf, exposing the confidentiality of the cryptographic material and potentially undermining the integrity of the service mesh. However, no exploits have been observed to date.