HashiCorp Consul v2.1.0: Nftables Migration, Stricter ACLs, and Security Patches

Introduction

HashiCorp Consul v2.1.0 was released on October 21, 2026. This is the first release of Consul tracked on terraformpilot.com, so there is no prior-version diff — everything below comes straight from the v2.1.0 release notes. The headline change is a hard cutover from iptables/ip6tables to nftables for transparent proxy traffic redirection, combined with several Enterprise-only tightening of API limits and ACL checks, and a batch of dependency/CVE fixes. Teams running Consul as a service mesh control plane, a Terraform state backend, or a service discovery layer should read the breaking changes before rolling this out.

What Is New

Breaking changes

Transparent proxy now uses nftables, not iptables (GH-23785). consul connect redirect-traffic is migrated to the sdk/nftables package, applying IPv4 and IPv6 rules atomically through the nftables inet address family instead of separate iptables/ip6tables calls. This requires the nft binary and a kernel with stateful NAT support in nftables inet chains — available upstream since Linux kernel 5.2, with some distributions (e.g. RHEL 8+, kernel 4.18+) backporting the support onto an older nominal kernel version. There is no automatic fallback to iptables.

# Confirm nft is installed and the kernel supports nftables inet NAT chains
which nft
uname -r

Transparent proxy exclusions are also validated more strictly now: user IDs must be numeric, and outbound exclusions must be IP addresses or CIDRs. Host names, user names, and UID ranges — previously accepted by the iptables path — are rejected.

In-place upgrades must clean up old iptables rules first. consul connect redirect-traffic does not remove rules created by earlier Consul versions. On an existing host/VM, remove any Consul-managed iptables rules before running the new command, or risk double NAT / inconsistent redirection. Consult the transparent proxy upgrade guide linked from the release notes for a reference cleanup script.

Official Consul Docker images now ship nftables instead of iptables — any custom scripts that exec into the container and call iptables need to be rewritten against nft.

(Enterprise only) Request body size limits. Agent HTTP API and Resource API (/api/...) requests are now capped at 512 KiB by default, including chunked requests, with oversized requests rejected as HTTP 413 before the body is fully read. Large /v1/config writes that previously succeeded can now fail. Raise the ceiling with limits.http_max_request_body_size:

# consul agent config (HCL), Enterprise only
limits {
  http_max_request_body_size = 2097152 # 2 MiB
}

This matters directly for teams using the consul Terraform backend for state storage: a state blob larger than 512 KiB written to an Enterprise Consul cluster will now be rejected unless the limit is raised.

terraform {
  backend "consul" {
    address = "consul.example.com:8500"
    scheme  = "https"
    path    = "terraform/state/myapp"
  }
}

(Enterprise only) Leaf certificate endpoint now checks ACLs on every call. GET /v1/agent/connect/ca/leaf/:service requires service:write on the requested service for every request, including requests that would previously be served from the agent's cached leaf certificate. Callers without that permission now get HTTP 403 instead of the cached cert.

service "web" {
  policy = "write"
}

(Enterprise only) Catalog.Register now requires write permission to update existing health checks. Tokens that previously updated a check without node/service write permission now receive a permission-denied error.

Experimental feature gate: api-gateway-upstream-routing. API Gateway HTTPRoute upstream-routing composition (PR #23294) is gated behind this flag. Disabled by default, it preserves the legacy HTTPRoute-to-router shape exactly. When an operator enables it after a full datacenter upgrade, service-router rules are composed with HTTPRoute matches, resolver subset definitions are preserved, and discovery-chain watches use the correct HTTP protocol override. The release notes do not include the exact CLI/config syntax to toggle this gate — check the release page before enabling it.

Security fixes

• Go upgraded to 1.26.10 (GH-24067).
• github.com/hashicorp/go-discover upgraded to v1.5.0, dropping the archived github.com/hashicorp/vic dependency, bumping govmomi to v0.55.1, and adding an srv provider for cloud auto-join (GH-24021).
• github.com/hashicorp/raft-wal upgraded to v0.5.0, pulling in raft v1.8.0, serf v0.11.0, memberlist v0.7.0, and go-metrics v0.7.0, and removing the github.com/coreos/etcd dependency (GH-23985).
• golang.org/x/net upgraded to v0.60.0, addressing GO-2026-6610, GO-2026-6611, GO-2026-6603, GO-2026-6617, and GO-2026-6612 (GH-23994).
• Alpine-based container images now run apk upgrade during build so base packages like sqlite and jq stay current (GH-23964).
• (Enterprise) OAuth JWKS merging during key rotation no longer has an unchecked size addition.
• Root module dependency on github.com/hashicorp/consul removed from several test fixtures to address CVE-2026-15972 and CVE-2026-88021 (GH-24043).
• Misc. dependency bumps for CVE coverage: klauspost/compress v1.18.7, go.mongodb.org/mongo-driver v1.17.10, moby/go-archive v0.3.0, go-openapi/swag v0.27.1.

Upgrade Steps

1. Check the currently running version on each agent:

consul version

2. If you use transparent proxy redirection (consul connect redirect-traffic) on existing hosts or VMs, remove any Consul-managed iptables/ip6tables rules before upgrading, using the cleanup script referenced in the transparent proxy upgrade guide. Skipping this can cause double NAT or broken traffic redirection.

3. Confirm nft is installed and the kernel supports nftables inet NAT chains (upstream kernel 5.2+, or a distribution with backported support such as RHEL 8+ / kernel 4.18+):

which nft || echo "install nftables before upgrading"

4. Upgrade the Consul binary or container image:

# package manager example
sudo apt-get update && sudo apt-get install consul=2.1.0
 
# or container image
docker pull hashicorp/consul:2.1.0

5. If you manage Consul-related resources from Terraform (e.g. the hashicorp/consul provider for catalog/config entries, or the consul backend), pin the provider and re-run init:

terraform {
  required_providers {
    consul = {
      source  = "hashicorp/consul"
      version = ">= 2.20.0" # pin to a provider release compatible with Consul 2.1.0
    }
  }
}

terraform init -upgrade

6. Roll the upgrade through the cluster one agent/server at a time, then restart consul connect redirect-traffic on proxy hosts so it reapplies rules via nftables.

7. (Enterprise) Review limits.http_max_request_body_size if you push large /v1/config payloads or large Terraform state writes through the consul backend, and audit ACL tokens used for leaf-cert fetches and Catalog.Register check updates against the new service:write requirements.

Verify

# Confirm the upgraded version is active
consul version
 
# Confirm nftables rules are in place instead of iptables (on proxy hosts)
nft list ruleset | grep -i consul
 
# Confirm cluster health post-upgrade
consul members
consul catalog nodes

For Enterprise clusters, send an oversized request against /v1/config or a Resource API endpoint and confirm it is rejected with HTTP 413 rather than accepted or timing out.

Conclusion

Consul v2.1.0 is a meaningful operational release for anyone using transparent proxy redirection: the move to nftables is mandatory with no iptables fallback, and in-place upgrades require manual cleanup of old rules first. Enterprise operators get three separate ACL/limit tightenings (API body size, leaf-cert cache bypass closed, Catalog.Register check permissions) that are worth testing against existing token policies before rolling to production. Everyone benefits from the Go 1.26.10 bump and the dependency/CVE cleanup across go-discover, raft-wal, and golang.org/x/net. Test the nftables migration and the Enterprise ACL changes in staging before touching production service mesh infrastructure.