Hashicorp Consul
36 CVEs affecting Hashicorp Consul. Latest disclosed: 2026-03-12. Critical: 0, High: 20.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41805 | High | 8.8 | 2021-12-12 | HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator… |
CVE-2021-37219 | High | 8.8 | 2021-09-07 | HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only func… |
CVE-2023-2816 | High | 8.7 | 2023-06-02 | Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy inst… |
CVE-2021-3121 | High | 8.6 | 2021-01-11 | An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue. |
CVE-2024-10006 | High | 8.3 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based acces… |
CVE-2024-10005 | High | 8.1 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-bas… |
CVE-2019-8336 | High | 8.1 | 2019-03-05 | HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbit… |
CVE-2022-29153 | High | 7.5 | 2022-04-19 | HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects re… |
CVE-2021-36213 | High | 7.5 | 2021-07-17 | HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing t… |
CVE-2021-32574 | High | 7.5 | 2021-07-17 | HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject… |
CVE-2021-28156 | High | 7.5 | 2021-04-20 | HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10. |
CVE-2020-25201 | High | 7.5 | 2020-11-04 | HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft… |
CVE-2020-13250 | High | 7.5 | 2020-06-11 | HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of… |
CVE-2020-13170 | High | 7.5 | 2020-06-11 | HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary d… |
CVE-2020-12758 | High | 7.5 | 2020-06-11 | HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7… |
CVE-2020-7219 | High | 7.5 | 2020-01-31 | HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of servic… |
CVE-2019-12291 | High | 7.5 | 2019-06-06 | HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by… |
CVE-2023-3518 | High | 7.4 | 2023-08-09 | HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in… |
CVE-2019-9764 | High | 7.4 | 2019-03-26 | HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostnam… |
CVE-2021-41803 | High | 7.1 | 2022-09-23 | HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assert… |