Showing 25 vulnerabilities on this page for github.com/hashicorp/consul

Signals CISA KEV Ransomware Nuclei
Go vulnerability results
VulnerabilityTitle and contextCVSSEPSSPoCsSignalsSTIX action

Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.

CWE-59Mar 11, 2026
CVSS6.8v3.1EPSS0.475%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Consul's KV endpoint is vulnerable to denial of service

Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.

CWE-770Oct 28, 2025
CVSS6.5v3.1EPSS0.396%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Consul's event endpoint is vulnerable to denial of service

Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.

CWE-770Oct 28, 2025
CVSS6.5v3.1EPSS0.393%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

CWE-79Oct 30, 2024
CVSS-v4.0EPSS0.418%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Consul L7 Intentions Vulnerable To Headers Bypass

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.

CWE-116CWE-644Oct 30, 2024
CVSS-v4.0EPSS0.463%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Consul L7 Intentions Vulnerable To URL Path Bypass

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.

CWE-22Oct 30, 2024
CVSS-v4.0EPSS0.715%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

CWE-266CWE-285Aug 9, 2023
CVSS7.4v3.1EPSS0.447%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Consul Cluster Peering can Result in Denial of Service

Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3

CWE-826Jun 2, 2023
CVSS4.9v3.1EPSS0.768%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

CWE-266Jun 2, 2023
CVSS8.7v3.1EPSS0.585%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Consul Server Panic when Ingress and API Gateways Configured with Peering

Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.

CWE-476Mar 9, 2023
CVSS4.9v3.1EPSS1.01%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Consul Peering Imported Nodes/Services Leak

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

CWE-862Nov 15, 2022
CVSS5.3v3.1EPSS0.66%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."

CWE-862Sep 23, 2022
CVSS7.1v3.1EPSS0.878%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

HashiCorp Consul vulnerable to authorization bypass

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

CWE-252Sep 23, 2022
CVSS6.5v3.1EPSS0.881%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.

CWE-918Apr 19, 20221 related artifact
CVSS7.5v3.1EPSS8.68%PoCs0SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei templateSTIX

HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3.

CWE-400Feb 24, 2022
CVSS6.5v3.1EPSS1.39%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

CWE-862CWE-863Sep 7, 2021
CVSS6.5v3.1EPSS1.52%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

HashiCorp Consul Privilege Escalation Vulnerability

HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.

CWE-295Sep 7, 2021
CVSS8.8v3.1EPSS1.15%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

HashiCorp Consul L7 deny intention results in an allow action

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.

Jul 17, 2021
CVSS7.5v3.1EPSS1.74%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Hashicorp Consul Missing SSL Certificate Validation

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.

CWE-295Jul 17, 2021
CVSS7.5v3.1EPSS1.46%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

HashiCorp Consul Cross-site Scripting vulnerability

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.

CWE-79Apr 20, 20211 related artifact
CVSS6.1v3.1EPSS6.1%PoCs0SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei templateSTIX

Privilege Escalation in HashiCorp Consul

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.

CWE-732CWE-863Nov 23, 2020
CVSS6.5v3.1EPSS1.38%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Denial of service in HashiCorp Consul

HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.

CWE-400CWE-834Nov 4, 2020
CVSS7.5v3.1EPSS2.61%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Improper Input Validation in HashiCorp Consul

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

CWE-20Jun 11, 2020
CVSS7.5v3.1EPSS1.73%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Incorrect Permission Assignment for Critical Resource in Hashicorp Consul

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

CWE-732Jun 11, 2020
CVSS5.3v3.1EPSS1.55%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Denial of Service (DoS) in HashiCorp Consul

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.

CWE-400CWE-404Jun 11, 2020
CVSS7.5v3.1EPSS1.71%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX