$ cat hashicorp/week/2026-09-07.log
the week in review · Sep 7 – Sep 13, 2026
Consul patches six security flaws
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Two pre-auth ACL bypasses and a memory exhaustion attack land in Consul, with backports to supported releases.
security: bound RPC header size to prevent pre-auth memory exhaustion (#23898) hashicorp/consul
The most severe of Consul's six security fixes: an mTLS-authenticated client with no ACL token could exhaust Consul server memory by sending oversized RPC headers. The fix bounds the header size before authentication.
security: reject non-default PeerName in Catalog.Deregister (#23897) hashicorp/consul
A local ACL token with service:write or node:write could delete peer-imported catalog objects by supplying a non-default PeerName in a Catalog.Deregister request. The patch rejects non-default PeerNames.
security: fix catalog node-ID ACL bypass allowing cross-node takeover (#23899) hashicorp/consul
A catalog node-ID ACL bypass allowed cross-node takeover; the fix requires write on the existing node when a request carries a foreign Node.ID, closing the vetRegisterWithACL path.
security: escape regex metacharacters in SPIFFE RBAC patterns (#23900) hashicorp/consul
Regex metacharacters in SPIFFE RBAC patterns were not escaped, letting intentions be bypassed. The xds layer now escapes them, and a negative test was added.
security: gate Lua/Wasm extensions and bootstrap escape-hatch keys behind mesh:write (#23901) hashicorp/consul
Lua/Wasm extension registration and bootstrap escape-hatch keys now require mesh:write, removing an unauthenticated configuration path.
fix: backport api-gateway error bulkheading hashicorp/consul
Consul backported API gateway error bulkheading to stop one broken route from discarding an entire listener's routing config, so correctly configured routes on the same listener keep working.
v2.11.0 hashicorp/go-tfe
go-tfe 2.11.0 ships stack-level notifications and lets PolicySetUpdateOptions.TagSelectorMatchingLogic be cleared, since the field is now NullableString. Pagination parameter types in GET responses that previously returned null are fixed.
Bump google.golang.org/grpc to v1.83.2 to fix GHSA-vp52-pcj8-j9qc (#1271) hashicorp/consul-dataplane
consul-dataplane bumps google.golang.org/grpc to v1.83.2 to address GHSA-vp52-pcj8-j9qc, a memory exhaustion DoS via fragmented HTTP/2 DATA frames.
$ ls hashicorp/week/ # the briefings behind this review
Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.