# github.com/hashicorp/consul (Go) vulnerabilities 32 known vulnerabilities (5 high, 8 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pkg.go.dev/github.com/hashicorp/consul ## Advisories (32) ### [CVE-2026-2808](https://cve.now/CVE-2026-2808): Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider - Severity: Medium 6.8 - Published: Mar 11, 2026 - Affected: fixed in 1.18.21; from 1.22.0-rc1, fixed in 1.22.5; from 1.19.0, fixed in 1.21.11; fixed in 1.22.5. ### [CVE-2025-11374](https://cve.now/CVE-2025-11374): Consul's KV endpoint is vulnerable to denial of service - Severity: Medium 6.5 - Published: Oct 28, 2025 - Affected: fixed in 1.22.0. ### [CVE-2025-11375](https://cve.now/CVE-2025-11375): Consul's event endpoint is vulnerable to denial of service - Severity: Medium 6.5 - Published: Oct 28, 2025 - Affected: fixed in 1.22.0. ### [CVE-2024-10086](https://cve.now/CVE-2024-10086): Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation - Severity: Medium 6.1 - Published: Oct 30, 2024 - Affected: from 1.4.1, fixed in 1.20.0. ### [CVE-2024-10006](https://cve.now/CVE-2024-10006): Consul L7 Intentions Vulnerable To Headers Bypass - Severity: High 8.3 - Published: Oct 30, 2024 - Affected: from 1.9.0, fixed in 1.20.1. ### [CVE-2024-10005](https://cve.now/CVE-2024-10005): Consul L7 Intentions Vulnerable To URL Path Bypass - Severity: High 8.1 - Published: Oct 30, 2024 - Affected: from 1.9.0, fixed in 1.20.1. ### [CVE-2023-3518](https://cve.now/CVE-2023-3518): JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access - Severity: High 7.4 - Published: Aug 9, 2023 - Affected: from 1.16.0, fixed in 1.16.1; from 1.16.0, fixed in 1.16.1. ### [CVE-2023-1297](https://cve.now/CVE-2023-1297): Consul Cluster Peering can Result in Denial of Service - Severity: Medium 4.9 - Published: Jun 2, 2023 - Affected: fixed in 1.14.5; from 1.15.0, fixed in 1.15.3; fixed in 1.14.5; from 1.15.0, fixed in 1.15.3. ### [CVE-2023-2816](https://cve.now/CVE-2023-2816): Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner - Severity: High 8.7 - Published: Jun 2, 2023 - Affected: from 1.15.0, fixed in 1.15.3. ### [CVE-2023-0845](https://cve.now/CVE-2023-0845): Consul Server Panic when Ingress and API Gateways Configured with Peering - Severity: Medium 4.9 - Published: Mar 9, 2023 - Affected: from 1.14.0, fixed in 1.14.5. ### [CVE-2022-3920](https://cve.now/CVE-2022-3920): Consul Peering Imported Nodes/Services Leak - Severity: Medium 5.3 - Published: Nov 15, 2022 - Affected: from 1.13.0, fixed in 1.14.0. ### [CVE-2022-40716](https://cve.now/CVE-2022-40716): HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal… - Severity: Medium 6.5 - Published: Sep 23, 2022 - Affected: fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.2; fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.2. ### [CVE-2021-41803](https://cve.now/CVE-2021-41803): HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and… - Severity: High 7.1 - Published: Sep 23, 2022 - Affected: from 1.8.1, fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.2; from 1.8.1, fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.2. ### [CVE-2022-29153](https://cve.now/CVE-2022-29153): HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent… - Severity: Unrated - Published: Apr 19, 2022 - Affected: fixed in 1.9.17; from 1.10.0, fixed in 1.10.10; from 1.11.0, fixed in 1.11.5; fixed in 1.9.17; from 1.10.0, fixed in 1.10.10; from 1.11.0, fixed in 1.11.5. ### [CVE-2022-24687](https://cve.now/CVE-2022-24687): HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user… - Severity: Unrated - Published: Feb 24, 2022 - Affected: from 1.8.0, fixed in 1.9.15; from 1.10.0, fixed in 1.10.8; from 1.11.0, fixed in 1.11.3; from 1.8.0, fixed in 1.9.15; from 1.10.0, fixed in 1.10.8; from 1.11.0, fixed in 1.11.3. ### [CVE-2021-38698](https://cve.now/CVE-2021-38698): HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access… - Severity: Unrated - Published: Sep 7, 2021 - Affected: fixed in 1.8.15; from 1.9.0, fixed in 1.9.9; from 1.10.1, fixed in 1.10.2; from 1.10.1, fixed in 1.10.2; from 1.9.0, fixed in 1.9.9; fixed in 1.8.15. ### [CVE-2021-37219](https://cve.now/CVE-2021-37219): HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to… - Severity: Unrated - Published: Sep 7, 2021 - Affected: fixed in 1.8.15; from 1.9.0, fixed in 1.9.9; from 1.10.1, fixed in 1.10.2; from 1.10.1, fixed in 1.10.2; from 1.9.0, fixed in 1.9.9; fixed in 1.8.15. ### [CVE-2021-36213](https://cve.now/CVE-2021-36213): HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action… - Severity: Unrated - Published: Jul 17, 2021 - Affected: fixed in 1.10.1. ### [CVE-2021-32574](https://cve.now/CVE-2021-32574): HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity… - Severity: Unrated - Published: Jul 17, 2021 - Affected: fixed in 1.10.1. ### [CVE-2020-25864](https://cve.now/CVE-2020-25864): HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. - Severity: Unrated - Published: Apr 20, 2021 - Affected: fixed in 1.7.14; from 1.8.0, fixed in 1.8.10; from 1.9.0, fixed in 1.9.5; from 1.9.0, fixed in 1.9.5; from 1.8.0, fixed in 1.8.10; fixed in 1.7.14. ### [CVE-2020-28053](https://cve.now/CVE-2020-28053): HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA… - Severity: Unrated - Published: Nov 23, 2020 - Affected: from 1.2.0, fixed in 1.6.10; from 1.7.0, fixed in 1.7.10; from 1.8.0, fixed in 1.8.6; from 1.2.0, fixed in 1.6.10; from 1.7.0, fixed in 1.7.10; from 1.8.0, fixed in 1.8.6. ### [CVE-2020-25201](https://cve.now/CVE-2020-25201): HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of… - Severity: Unrated - Published: Nov 4, 2020 - Affected: from 1.7.0, fixed in 1.7.9; from 1.8.0, fixed in 1.8.5; from 1.7.0, fixed in 1.7.9; from 1.8.0, fixed in 1.8.5. ### [CVE-2020-13170](https://cve.now/CVE-2020-13170): HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where… - Severity: Unrated - Published: Jun 11, 2020 - Affected: from 1.6.0-beta1, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4; from 1.6.0-beta1, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4. ### [CVE-2020-12797](https://cve.now/CVE-2020-12797): HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. - Severity: Unrated - Published: Jun 11, 2020 - Affected: from 1.6.0, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4; from 1.6.0, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4. ### [CVE-2020-12758](https://cve.now/CVE-2020-12758): HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. - Severity: Unrated - Published: Jun 11, 2020 - Affected: from 1.6.0-beta1, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4; from 1.6.0-beta1, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4. ### [CVE-2020-13250](https://cve.now/CVE-2020-13250): HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was… - Severity: Unrated - Published: Jun 11, 2020 - Affected: from 1.2.0, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4; from 1.2.0, fixed in 1.6.6; from 1.7.0, fixed in 1.7.4. ### [CVE-2020-7219](https://cve.now/CVE-2020-7219): HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to… - Severity: Unrated - Published: Jan 31, 2020 - Affected: fixed in 1.6.3. ### [CVE-2020-7955](https://cve.now/CVE-2020-7955): HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential… - Severity: Unrated - Published: Jan 31, 2020 - Affected: from 1.4.1, fixed in 1.6.3. ### [CVE-2019-12291](https://cve.now/CVE-2019-12291): HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. - Severity: Unrated - Published: Jun 6, 2019 - Affected: from 1.4.0, fixed in 1.5.1. ### [CVE-2019-9764](https://cve.now/CVE-2019-9764): HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. - Severity: Unrated - Published: Mar 26, 2019 - Affected: fixed in 1.4.4. ### [CVE-2019-8336](https://cve.now/CVE-2019-8336): HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the… - Severity: Unrated - Published: Mar 5, 2019 - Affected: from 1.4.0, fixed in 1.4.3. ### [CVE-2018-19653](https://cve.now/CVE-2018-19653): HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify\_outgoing setting is improperly… - Severity: Unrated - Published: Dec 9, 2018 - Affected: from 0.5.1, fixed in 1.4.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/hashicorp/consul Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.