Skip to content
consulGHSA-6hw5-6gcx-phmw

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.

Medium6.5CVE-2021-38698 · Published Sep 8, 2021 · updated Sep 10, 2026

GitHub advisory

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.10.1, < 1.10.21.10.2
>= 1.9.0, < 1.9.91.9.9
< 1.8.151.8.15
Details and references

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-862, CWE-863
Also known as
BIT-consul-2021-38698, CVE-2021-38698, GO-2022-0559

More consul advisories

All
DateAdvisory
Sep 82021HashiCorp Consul Privilege Escalation Vulnerability
CVE-2021-37219High8.8fixed in 1.8.15, 1.9.9, 1.10.2
Jul 282021Incorrect Authorization in HashiCorp Consul
CVE-2020-7955Medium5.3fixed in 1.6.3
Jul 192021HashiCorp Consul L7 deny intention results in an allow action
CVE-2021-36213High7.5fixed in 1.10.1
Jul 192021Hashicorp Consul Missing SSL Certificate Validation
CVE-2021-32574High7.5fixed in 1.10.1
Jun 232021Incorrect Permission Assignment for Critical Resource in Hashicorp Consul
CVE-2020-12797Medium5.3fixed in 1.6.6, 1.7.4
May 182021Allocation of Resources Without Limits or Throttling in Hashicorp Consul
CVE-2020-13250High7.5fixed in 1.6.6, 1.7.4

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.