AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-9rhf-q362-77mx

Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers

Consul

CVE-2023-3518 · Published Aug 9, 2023 · updated Aug 7, 2026

High7.4
Fix: upgrade to 1.16.1 or later
GitHub advisory

A vulnerability was identified in Consul such that using JWT authentication for service mesh incorrectly allows/denies access regardless of service identities. This vulnerability, CVE-2023-3518, affects Consul 1.16.0 and was fixed in 1.16.1.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.16.0, < 1.16.11.16.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Severity from
GitHub (reviewed advisory)
Weakness
CWE-266, CWE-285
Also known as
BIT-consul-2023-3518, CVE-2023-3518, GO-2024-2704

More Consul advisories

All Consul
Medium 6.5Jan 31, 2024Privilege Escalation in HashiCorp ConsulCVE-2020-28053fixed in 1.6.10 +2High 7.5Jan 31, 2024Denial of service in HashiCorp ConsulCVE-2020-25201fixed in 1.7.9 +1High 7.5Jun 9, 2023HashiCorp Consul Incorrect Access Control vulnerabilityCVE-2019-12291fixed in 1.5.1Medium 4.9Jun 3, 2023Hashicorp Consul vulnerable to denial of serviceCVE-2023-1297fixed in 1.14.5 +1High 8.7Jun 3, 2023Hashicorp Consul allows user with service:write permissions to patch remote proxy instancesCVE-2023-2816fixed in 1.15.3Medium 6.5Mar 9, 2023Consul Server Panic when Ingress and API Gateways Configured with Peering ConnectionsCVE-2023-0845fixed in 1.14.5