- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 32 · 5 high, 8 medium
- Registry
- pkg.go.dev
Advisories 32
- CVE-2026-2808Medium 6.8
Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider
Affected: fixed in 1.18.21; from 1.22.0-rc1, fixed in 1.22.5; from 1.19.0, fixed in 1.21.11; fixed in 1.22.5.
- CVE-2025-11374Medium 6.5
Consul's KV endpoint is vulnerable to denial of service
Affected: fixed in 1.22.0.
- CVE-2025-11375Medium 6.5
Consul's event endpoint is vulnerable to denial of service
Affected: fixed in 1.22.0.
- CVE-2024-10086Medium 6.1
Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation
Affected: from 1.4.1, fixed in 1.20.0.
- CVE-2024-10006High 8.3
Consul L7 Intentions Vulnerable To Headers Bypass
Affected: from 1.9.0, fixed in 1.20.1.
- CVE-2024-10005High 8.1
Consul L7 Intentions Vulnerable To URL Path Bypass
Affected: from 1.9.0, fixed in 1.20.1.
- CVE-2023-3518High 7.4
JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access
Affected: from 1.16.0, fixed in 1.16.1; from 1.16.0, fixed in 1.16.1.
- CVE-2023-1297Medium 4.9
Consul Cluster Peering can Result in Denial of Service
Affected: fixed in 1.14.5; from 1.15.0, fixed in 1.15.3; fixed in 1.14.5; from 1.15.0, fixed in 1.15.3.
- CVE-2023-2816High 8.7
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
Affected: from 1.15.0, fixed in 1.15.3.
- CVE-2023-0845Medium 4.9
Consul Server Panic when Ingress and API Gateways Configured with Peering
Affected: from 1.14.0, fixed in 1.14.5.
- CVE-2022-3920Medium 5.3
Consul Peering Imported Nodes/Services Leak
Affected: from 1.13.0, fixed in 1.14.0.
- CVE-2022-40716Medium 6.5
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal…
Affected: fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.2; fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.2.
- CVE-2021-41803High 7.1
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and…
Affected: from 1.8.1, fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.2; from 1.8.1, fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.2.
- CVE-2022-29153Unrated
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent…
Affected: fixed in 1.9.17; from 1.10.0, fixed in 1.10.10; from 1.11.0, fixed in 1.11.5; fixed in 1.9.17; from 1.10.0, fixed in 1.10.10; from 1.11.0, fixed in 1.11.5.
- CVE-2022-24687Unrated
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user…
Affected: from 1.8.0, fixed in 1.9.15; from 1.10.0, fixed in 1.10.8; from 1.11.0, fixed in 1.11.3; from 1.8.0, fixed in 1.9.15; from 1.10.0, fixed in 1.10.8; from 1.11.0, fixed in 1.11.3.
Show all 32 advisoriesShow fewer advisories
- CVE-2021-38698Unrated
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access…
Affected: fixed in 1.8.15; from 1.9.0, fixed in 1.9.9; from 1.10.1, fixed in 1.10.2; from 1.10.1, fixed in 1.10.2; from 1.9.0, fixed in 1.9.9; fixed in 1.8.15.
- CVE-2021-37219Unrated
HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to…
Affected: fixed in 1.8.15; from 1.9.0, fixed in 1.9.9; from 1.10.1, fixed in 1.10.2; from 1.10.1, fixed in 1.10.2; from 1.9.0, fixed in 1.9.9; fixed in 1.8.15.
- CVE-2021-36213Unrated
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action…
Affected: fixed in 1.10.1.
- CVE-2021-32574Unrated
HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity…
Affected: fixed in 1.10.1.
- CVE-2020-25864Unrated
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting.
Affected: fixed in 1.7.14; from 1.8.0, fixed in 1.8.10; from 1.9.0, fixed in 1.9.5; from 1.9.0, fixed in 1.9.5; from 1.8.0, fixed in 1.8.10; fixed in 1.7.14.
- CVE-2020-28053Unrated
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA…
Affected: from 1.2.0, fixed in 1.6.10; from 1.7.0, fixed in 1.7.10; from 1.8.0, fixed in 1.8.6; from 1.2.0, fixed in 1.6.10; from 1.7.0, fixed in 1.7.10; from 1.8.0, fixed in 1.8.6.
- CVE-2020-25201Unrated
HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of…
Affected: from 1.7.0, fixed in 1.7.9; from 1.8.0, fixed in 1.8.5; from 1.7.0, fixed in 1.7.9; from 1.8.0, fixed in 1.8.5.
- CVE-2020-13170Unrated
HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where…
Affected: from 1.6.0-beta1, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4; from 1.6.0-beta1, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4.
- CVE-2020-12797Unrated
HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers.
Affected: from 1.6.0, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4; from 1.6.0, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4.
- CVE-2020-12758Unrated
HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry.
Affected: from 1.6.0-beta1, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4; from 1.6.0-beta1, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4.
- CVE-2020-13250Unrated
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was…
Affected: from 1.2.0, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4; from 1.2.0, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4.
- CVE-2020-7219Unrated
HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to…
Affected: fixed in 1.6.3.
- CVE-2020-7955Unrated
HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential…
Affected: from 1.4.1, fixed in 1.6.3.
- CVE-2019-12291Unrated
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control.
Affected: from 1.4.0, fixed in 1.5.1.
- CVE-2019-9764Unrated
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication.
Affected: fixed in 1.4.4.
- CVE-2019-8336Unrated
HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the…
Affected: from 1.4.0, fixed in 1.4.3.
- CVE-2018-19653Unrated
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly…
Affected: from 0.5.1, fixed in 1.4.1.