AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-gw2g-hhc9-wgjh

Missing Authorization in HashiCorp Consul

Consul

CVE-2022-3920 · Published Nov 16, 2022 · updated Aug 7, 2026

High7.5
Fix: upgrade to 1.14.0 or later
GitHub advisory

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.13.0, < 1.14.01.14.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-862
Also known as
BIT-consul-2022-3920, CVE-2022-3920, GO-2022-1121

More Consul advisories

All Consul
Medium 6.5Mar 9, 2023Consul Server Panic when Ingress and API Gateways Configured with Peering ConnectionsCVE-2023-0845fixed in 1.14.5Medium 6.5Sep 25, 2022HashiCorp Consul vulnerable to authorization bypassCVE-2022-40716fixed in 1.11.9 +2High 7.1Sep 25, 2022HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertionsCVE-2021-41803fixed in 1.11.9 +2Medium 6.1May 24, 2022HashiCorp Consul Cross-site Scripting vulnerabilityCVE-2020-25864fixed in 1.7.14 +2Medium 5.9May 14, 2022HashiCorp Consul can use cleartext agent-to-agent RPC communicationCVE-2018-19653fixed in 1.4.1High 7.4May 13, 2022HashiCorp Consul vulnerable to Origin Validation ErrorCVE-2019-9764fixed in 1.4.4