consulGHSA-6hw5-6gcx-phmw
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.
Medium6.5CVE-2021-38698 · Published Sep 8, 2021 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.10.1, < 1.10.2 | 1.10.2 |
| >= 1.9.0, < 1.9.9 | 1.9.9 | |
| < 1.8.15 | 1.8.15 |
Details and references
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
More consul advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 82021 | HashiCorp Consul Privilege Escalation Vulnerability CVE-2021-37219High8.8fixed in 1.8.15, 1.9.9, 1.10.2 | High8.8 | 1.8.15, 1.9.9, 1.10.2 |
| Jul 282021 | Incorrect Authorization in HashiCorp Consul CVE-2020-7955Medium5.3fixed in 1.6.3 | Medium5.3 | 1.6.3 |
| Jul 192021 | HashiCorp Consul L7 deny intention results in an allow action CVE-2021-36213High7.5fixed in 1.10.1 | High7.5 | 1.10.1 |
| Jul 192021 | Hashicorp Consul Missing SSL Certificate Validation CVE-2021-32574High7.5fixed in 1.10.1 | High7.5 | 1.10.1 |
| Jun 232021 | Incorrect Permission Assignment for Critical Resource in Hashicorp Consul CVE-2020-12797Medium5.3fixed in 1.6.6, 1.7.4 | Medium5.3 | 1.6.6, 1.7.4 |
| May 182021 | Allocation of Resources Without Limits or Throttling in Hashicorp Consul CVE-2020-13250High7.5fixed in 1.6.6, 1.7.4 | High7.5 | 1.6.6, 1.7.4 |