AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-6hw5-6gcx-phmw

Consul: missing authorization

Consul

CVE-2021-38698 · Published Sep 8, 2021 · updated Sep 10, 2026

Medium6.5
Fix: upgrade to 1.8.15 or later (3 fixed versions below)
GitHub advisory

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.10.1, < 1.10.21.10.2
>= 1.9.0, < 1.9.91.9.9
< 1.8.151.8.15
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-862, CWE-863
Also known as
BIT-consul-2021-38698, CVE-2021-38698, GO-2022-0559

More Consul advisories

All Consul
High 8.8Sep 8, 2021HashiCorp Consul Privilege Escalation VulnerabilityCVE-2021-37219fixed in 1.8.15 +2Medium 5.3Jul 28, 2021Incorrect Authorization in HashiCorp ConsulCVE-2020-7955fixed in 1.6.3High 7.5Jul 19, 2021HashiCorp Consul L7 deny intention results in an allow actionCVE-2021-36213fixed in 1.10.1High 7.5Jul 19, 2021Hashicorp Consul Missing SSL Certificate ValidationCVE-2021-32574fixed in 1.10.1Medium 5.3Jun 23, 2021Incorrect Permission Assignment for Critical Resource in Hashicorp ConsulCVE-2020-12797fixed in 1.6.6 +1High 7.5May 18, 2021Allocation of Resources Without Limits or Throttling in Hashicorp ConsulCVE-2020-13250fixed in 1.6.6 +1