Hashicorp Consul Enterprise
19 CVEs affecting Hashicorp Consul Enterprise. Latest disclosed: 2026-08-07. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2816 | High | 8.7 | 2023-06-02 | Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy inst… |
CVE-2024-10006 | High | 8.3 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based acces… |
CVE-2024-10005 | High | 8.1 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-bas… |
CVE-2026-15972 | High | 7.5 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection accepta… |
CVE-2023-3518 | High | 7.4 | 2023-08-09 | HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in… |
CVE-2026-19017 | Medium | 6.8 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect C… |
CVE-2026-2808 | Medium | 6.8 | 2026-03-12 | HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. T… |
CVE-2025-11375 | Medium | 6.5 | 2025-10-28 | Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. Th… |
CVE-2025-11374 | Medium | 6.5 | 2025-10-28 | Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This v… |
CVE-2024-10086 | Medium | 6.1 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-p… |
CVE-2026-19113 | Medium | 5.3 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints… |
CVE-2026-19015 | Medium | 5.3 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoin… |
CVE-2026-19012 | Medium | 5.3 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition… |
CVE-2022-3920 | Medium | 5.3 | 2022-11-16 | HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the… |
CVE-2023-1297 | Medium | 4.9 | 2023-06-02 | Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could co… |
CVE-2023-0845 | Medium | 4.9 | 2023-03-09 | Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to… |
CVE-2026-19014 | Medium | 4.3 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization e… |
CVE-2026-19016 | Medium | 4.2 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submit… |
CVE-2026-15970 | Medium | 4.2 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured w… |