ConsulGHSA-hr3v-8cp3-68rf
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
High7.1CVE-2021-41803 · Published Sep 25, 2022 · updated Aug 7, 2026
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.8.1, < 1.11.9 | 1.11.9 |
| >= 1.12.0, < 1.12.5 | 1.12.5 | |
| >= 1.13.0, < 1.13.2 | 1.13.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-862
- Also known as
- BIT-consul-2021-41803, CVE-2021-41803, GO-2024-2683
- nvd.nist.gov/vuln/detail/CVE-2021-41803
- github.com/hashicorp/consul/pull/14577/commits/2c881259ce10e308ff03afc968c4165998fd7fee
- discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627
- github.com/hashicorp/consul
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI
More Consul advisories
All Consul| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 162022 | Missing Authorization in HashiCorp Consul High7.5Nov 16, 2022 | High7.5 | 1.14.0 |
| Sep 252022 | HashiCorp Consul vulnerable to authorization bypassMedium6.5Sep 25, 2022 | Medium6.5 | 1.11.9+2 more |
| May 242022 | HashiCorp Consul Cross-site Scripting vulnerabilityMedium6.1May 24, 2022 | Medium6.1 | 1.7.14+2 more |
| May 142022 | HashiCorp Consul can use cleartext agent-to-agent RPC communicationMedium5.9May 14, 2022 | Medium5.9 | 1.4.1 |
| May 132022 | HashiCorp Consul vulnerable to Origin Validation ErrorHigh7.4May 13, 2022 | High7.4 | 1.4.4 |
| May 132022 | HashiCorp Consul Access Restriction BypassHigh8.1May 13, 2022 | High8.1 | 1.4.3 |