Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector

High7.5CVE-2022-29153 · Published Apr 20, 2022 · updated Sep 10, 2026

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that HTTP health check endpoints returning an HTTP redirect may be abused as a vector for server-side request forgery (SSRF). This vulnerability, CVE-2022-29153, was fixed in Consul 1.9.17, 1.10.10, and 1.11.5.