CVE-2026-87090 is an incorrect authorization vulnerability (CWE-863) affecting HashiCorp Consul and Consul Enterprise. The issue exists in the catalog node-write path, where an attacker with node-write permission on one node can bypass authorization controls to delete another node's catalog registration and take over its identity, provided they know the node ID of the target node. This could lead to impersonation of nodes within the Consul service catalog. The vulnerability has a CVSS 3.1 score of 8.3, indicating high severity. Official patches are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.

An attacker with valid node-write permissions on any single node and knowledge of another node's ID can delete that node's catalog registration and assume its identity. This could lead to unauthorized actions performed under the guise of the impersonated node, potentially impacting service discovery and trust within the Consul environment. The vulnerability affects confidentiality (low), integrity (high), and availability (high) as per the CVSS vector.

This vulnerability is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Users should upgrade to these versions or later to remediate the issue. No other mitigation or workaround is indicated in the available data.