Consul:

Exploitation

RCE via service health checks, exec API, and ACL token theft

1 guide • Created Apr 4, 2026 • Updated Sep 14, 2026

1 guide

Consul RCE

Exploiting HashiCorp Consul misconfigurations to achieve Remote Code Execution via the HTTP API, service registration endpoints, and exec functionality.

Sep 14, 2026 • 3 min read