consul

2.1.0-rc2 (October 12, 2026)

SECURITY:

• Upgrade go version to 1.26.9 to address security vulnerabilities. [GH-24010]
• deps: Upgrade github.com/hashicorp/raft-wal to v0.5.0 (with raft v1.8.0, serf v0.11.0, memberlist v0.7.0 and go-metrics v0.7.0), removing the dependency on github.com/coreos/etcd. [GH-23985]
• deps: Upgrade golang.org/x/net to v0.60.0 to address GO-2026-6610, GO-2026-6611, GO-2026-6603, GO-2026-6617 and GO-2026-6612. [GH-23994]
• docker: Run apk upgrade when building the Alpine-based container images so base-image packages (such as sqlite and jq) are up to date. [GH-23964]
• security: Upgrade github.com/klauspost/compress to v1.18.7, go.mongodb.org/mongo-driver to v1.17.10, github.com/moby/go-archive to v0.3.0 and github.com/go-openapi/swag to v0.27.1 to address CVE-2026-63209, CVE-2026-88031, CVE-2026-2303, CVE-2026-17106 and CVE-2026-85280. [GH-23964]
• ui: Add Content-Security-Policy header to Consul UI HTTP responses to mitigate XSS and data injection attacks. [GH-23971]
• ui: Pin a newer resolution of morgan to 1.12.1 to address GHSA-9f6g-j8ch-79g4 [GH-23952]

IMPROVEMENTS:

• connect: deliver the sidecar proxy's leaf certificate and CA roots to Envoy over SDS instead of embedding them inline in the public listener. Leaf certificate rotation is now a hitless hot-swap that no longer changes the listener filter chain hash, so established connections (notably long-lived TCP sessions) are no longer drained and terminated on every rotation. [GH-23938]
• terminating-gateway: deliver each linked service's Connect leaf certificate and the shared CA roots to Envoy over SDS instead of embedding them inline in the gateway's downstream filter chains. Leaf rotation no longer changes the filter chain hash, so established connections through the gateway are no longer drained. [GH-23938]

BUG FIXES:

• proxycfg: Fixed a goroutine and memory leak where a proxy's watches kept running after its state stopped unexpectedly, because replacing, deregistering or closing a stopped state did not cancel them. [GH-23990]
• proxycfg: Fixed a goroutine and memory leak where transparent proxies registered a new health watch for every imported peered service each time the imported services list changed, and never stopped watches for removed upstreams. [GH-23990]
• telemetry: Restore Raft, Serf, and Memberlist metrics in release artifacts by building with the hashicorpmetrics tag. [GH-23813]

2.1.0-rc1 (September 28, 2026)

BREAKING CHANGES:

• cli: Migrated the consul connect redirect-traffic command from iptables/ip6tables to nftables (nft). The command now uses the sdk/nftables package, which applies all IPv4 and IPv6 rules atomically in a single pass via the nftables inet address family, instead of separate iptables and ip6tables invocations. [GH-23785]
• cli: Transparent proxy exclusions are now validated before rules are applied: user IDs must be numeric and outbound exclusions must be IP addresses or CIDRs. iptables previously also accepted user names, UID ranges, and host names. [GH-23785]
• cli: consul connect redirect-traffic does not remove iptables/ip6tables rules created by earlier Consul versions. This only matters when upgrading an existing host or VM in place. Before running the new command on an existing host or VM, remove any Consul-managed iptables rules first (see the transparent proxy upgrade guide for a reference cleanup script). Leaving both rule sets in place can cause double NAT or inconsistent traffic redirection. [GH-23785]
• docker: The official Consul container images now include nftables instead of iptables. Scripts that run iptables inside the Consul image must be updated. [GH-23785]
• sdk: Replaced the iptables package with a new nftables package for transparent proxy traffic redirection. Traffic redirection now requires the nft binary and a Linux kernel with stateful NAT support in nftables inet family chains, available upstream starting with Linux kernel version 5.2 (some distributions backport this support onto an earlier nominal kernel version, for example RHEL 8+, kernel 4.18+, and its derivatives). There is no automatic fallback to iptables/ip6tables, so hosts without this kernel support will fail to set up transparent proxy redirection. [GH-23785]

SECURITY:

• Added debounce behavior to enforce a minimum interval between expensive federation-state anti-entropy sync operations. [GH-23196]
• Update brace-expansion to address GHSA-rgw5-rvv9-x895 (DoS via unbounded intermediate arrays). [GH-23786]
• Update fast-uri to address GHSA-7p8r-x3mc-p8w7 (Host Confusion via backslash authority introducer). [GH-23786]
• Update socket.io-parser to address CVE-2026-69185 (Zero-attachment Memory Exhaustion). [GH-23786]

FEATURES:

• agent: (Enterprise only) Add an inline ai block to service definitions, letting a workload declare its AI role (inference-model, mcp-server, or ai-agent) and role-specific configuration in a single registration via config files and HTTP APIs. [GH-13032]
• api-gateway: Add http2 and grpc as valid API Gateway listener protocols, enabling end-to-end HTTP/2 and gRPC from client to backend. Previously only http and tcp were accepted; the gateway would silently downgrade gRPC/HTTP2 traffic to HTTP/1.1 on the upstream hop. The new protocols render the correct downstream HTTP connection manager (HTTP/2 codec, h2,http/1.1 ALPN) and align the upstream cluster to HTTP/2, closing the parity gap with Ingress Gateway. [GH-23784]
• api-gateway: Auto-register DNS for services exposed via an API Gateway, resolvable at <service>.api-gateway.consul. Populates the gateway-services cat

2.0.4 (September 10, 2026)

BREAKING CHANGES:

• acl: Tokens that hold service:write but not mesh:write will now receive a permission-denied error when attempting to attach builtin/lua or builtin/wasm EnvoyExtensions (or upstream envoy_listener_json/envoy_cluster_json escape-hatch overrides) to a service-defaults config entry, or when registering a connect-proxy sidecar with bootstrap or xDS escape-hatch keys set in the top-level Proxy.Config map or per-upstream in Proxy.Upstreams[*].Config. Operators must grant mesh:write to any token that legitimately needs these capabilities. [GH-23864]
• fips: (Enterprise only) FIPS release artifacts are renamed. Version metadata changes from +ent.fips1402 to +ent.fips1403, and package and container artifacts change from the F2 suffix to F3 (for example, consul-F2_1.20.4-1_amd64.deb becomes consul-F3_1.20.4-1_amd64.deb). Pipelines that pin FIPS artifact names or version strings must be updated.

SECURITY:

• Upgrade go version to 1.26.7 to address security vulnerabilities. [GH-23869]
• acl: Require mesh:write in addition to service:write when attaching code-executing EnvoyExtensions (builtin/lua, builtin/wasm) or upstream escape-hatch overrides (envoy_listener_json, envoy_cluster_json in UpstreamConfig defaults or overrides) to a service-defaults config entry. Previously a holder of service:write on a service could attach a Lua script or Wasm module, or an upstream escape-hatch override, that Envoy compiled and executed on every proxied request as the sidecar process user, with access to mTLS private keys, request bodies, and the host filesystem. [GH-23864]
• acl: Require mesh:write in addition to service:write when registering a connect-proxy sidecar with bootstrap or xDS escape-hatch keys, whether set in the top-level Proxy.Config map or per-upstream in Proxy.Upstreams[*].Config (envoy_bootstrap_json_tpl, envoy_extra_static_listeners_json, envoy_public_listener_json, envoy_listener_json, envoy_cluster_json, envoy_local_cluster_json, envoy_extra_static_clusters_json, envoy_extra_stats_sinks_json, envoy_tracing_json, envoy_stats_config_json, envoy_listener_tracing_json). Key matching is case-insensitive to match the mapstructure decoding used downstream. Previously a holder of service:write on the proxy and its destination could inject arbitrary Envoy filter chain configuration into the sidecar bootstrap or xDS resources, including via a per-upstream override or a mixed-case key. [GH-23864]
• agent: Fixed a pre-authorization memory exhaustion vulnerability where an mTLS-authenticated RPC client with no ACL token could terminate a Consul server by sending a MessagePack request header with a large declared length. The MessagePack decoder allocated a byte slice of the declared size before method lookup, ACL token validation, or the rate-limiting interceptor could run, allowing a single oversized header to OOM-kill the server process.

Two mitigations are applied:

1. Each RPC request header is now validated against RPCMaxHeaderBytes (default 512 bytes) before it is decoded. Every length prefix in the header is checked against the limit, so an oversized value is rejected before the decoder allocates memory for it, and the connection is closed before any ACL evaluation. Request bodies remain unbounded by this limit.

2. A per-request read deadline (reusing RPCHandshakeTimeout) is applied inside handleConsulConn and handleInsecureConn so that a slow attacker trickling an oversized header cannot retain a goroutine and logical heap indefinitely.

• catalog: Fixed an incorrect authorization vulnerability where a local ACL token with service:write or node:write could delete peer-imported catalog objects by supplying a non-defa

2.0.3 (August 7, 2026)

SECURITY:

• Update brace-expansion to address GHSA-rgw5-rvv9-x895 (DoS via unbounded intermediate arrays). [GH-23786]
• Update fast-uri to address GHSA-7p8r-x3mc-p8w7 (Host Confusion via backslash authority introducer). [GH-23786]
• Update golang.org/x/text to v0.39.0 to address GO-2026-5970. [GH-23761]
• Update google.golang.org/grpc to v1.82.1 to address GHSA-hrxh-6v49-42gf. [GH-23761]
• Update socket.io-parser to address CVE-2026-69185 (Zero-attachment Memory Exhaustion). [GH-23786]
• Upgrade to use Go 1.26.5. This resolves vulnerabilities GO-2026-4970 (os). GO-2026-5856 (crypto/tls). [GH-23761]
• agent: Fixed a denial-of-service vulnerability where GET /v1/agent/connect/ca/roots and POST /v1/agent/connect/authorize used the agent-side cache unconditionally, even when http_config { use_cache = false } was configured by the operator. A remote caller could bypass this setting and grow the agent cache without bound by varying the request ACL token. Both endpoints now skip the cache and issue a direct RPC when use_cache is disabled. (SECVULN-50292, SECVULN-50293) [GH-23797]
• agent: Fixed a nil-pointer dereference panic in ShadowServiceRouterConfigEntry.CheckEnt when a service-router config entry contained a route with a nil Destination. A crafted snapshot restore or replication message containing such an entry could crash the FSM decode path. The nil guard now treats a missing destination as non-enterprise data and continues decoding safely. (SECVULN-50291) [GH-23797]
• agent: Fixed a security bypass where a user-supplied public listener (envoy_public_listener_json) with an HTTP Connection Manager filter would skip Consul's inbound request-normalization defaults. An attacker could exploit the un-normalized path to bypass L7 intention deny rules using percent-encoded path equivalents. Consul now injects path normalization (enabled by default, unless the mesh config option InsecureDisablePathNormalization is set) on every HCM filter chain in user-provided public listeners before L7 intention enforcement is applied. (SECVULN-50295) [GH-23797]
• agent: Fixed an unauthenticated denial-of-service vulnerability where PUT /v1/agent/check/update/:id, PUT /v1/agent/check/register, PUT /v1/agent/service/register, and POST /v1/agent/connect/authorize decoded unbounded JSON request bodies before resolving the caller's ACL token. An unauthenticated caller could retain multiple large JSON decoder buffers concurrently inside the Consul process before each request was rejected with HTTP 403, causing attacker-controlled heap growth. All four endpoints now cap the request body at 512 KiB before any decoding occurs, returning HTTP 413 for oversized bodies. This limit applies to chunked transfer encoding as well as declared Content-Length. (SECVULN-50418) [GH-23796]
• agent: Fixed an unauthenticated denial-of-service vulnerability where the external gRPC and gRPC-TLS listeners accepted an unlimited number of TCP connections per source IP before any request processing, ACL check, or rate limiting could occur. A remote attacker could exhaust ag