Advisoriesby Ibis
Consul security advisories
32 advisories · none critical or high in 12 months · latest Mar 12
32 advisories
Consul is vulnerable to arbitrary file read when configured with Kubernetes authenticationCVE-2026-2808fixed in 1.18.21 +2Consul key/value endpoint is vulnerable to denial of serviceCVE-2025-11374fixed in 1.22.0Consul event endpoint is vulnerable to denial of serviceCVE-2025-11375fixed in 1.22.0Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerabilityCVE-2024-10006fixed in 1.20.1Hashicorp Consul Cross-site Scripting vulnerabilityCVE-2024-10086fixed in 1.20.0Hashicorp Consul Path Traversal vulnerabilityCVE-2024-10005fixed in 1.20.1Privilege Escalation in HashiCorp ConsulCVE-2020-28053fixed in 1.6.10 +2Denial of service in HashiCorp ConsulCVE-2020-25201fixed in 1.7.9 +1Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT ProvidersCVE-2023-3518fixed in 1.16.1HashiCorp Consul Incorrect Access Control vulnerabilityCVE-2019-12291fixed in 1.5.1Hashicorp Consul vulnerable to denial of serviceCVE-2023-1297fixed in 1.14.5 +1Hashicorp Consul allows user with service:write permissions to patch remote proxy instancesCVE-2023-2816fixed in 1.15.3Consul Server Panic when Ingress and API Gateways Configured with Peering ConnectionsCVE-2023-0845fixed in 1.14.5Missing Authorization in HashiCorp ConsulCVE-2022-3920fixed in 1.14.0HashiCorp Consul vulnerable to authorization bypassCVE-2022-40716fixed in 1.11.9 +2HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertionsCVE-2021-41803fixed in 1.11.9 +2HashiCorp Consul Cross-site Scripting vulnerabilityCVE-2020-25864fixed in 1.7.14 +2HashiCorp Consul can use cleartext agent-to-agent RPC communicationCVE-2018-19653fixed in 1.4.1HashiCorp Consul vulnerable to Origin Validation ErrorCVE-2019-9764fixed in 1.4.4HashiCorp Consul Access Restriction BypassCVE-2019-8336fixed in 1.4.3Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vectorCVE-2022-29153fixed in 1.9.17 +2HashiCorp Consul Ingress Gateway Panic Can Shutdown ServersCVE-2022-24687fixed in 1.9.15 +2Denial of Service (DoS) in HashiCorp ConsulCVE-2020-12758fixed in 1.6.6 +1Consul: missing authorizationCVE-2021-38698fixed in 1.8.15 +2HashiCorp Consul Privilege Escalation VulnerabilityCVE-2021-37219fixed in 1.8.15 +2Incorrect Authorization in HashiCorp ConsulCVE-2020-7955fixed in 1.6.3HashiCorp Consul L7 deny intention results in an allow actionCVE-2021-36213fixed in 1.10.1Hashicorp Consul Missing SSL Certificate ValidationCVE-2021-32574fixed in 1.10.1Incorrect Permission Assignment for Critical Resource in Hashicorp ConsulCVE-2020-12797fixed in 1.6.6 +1Allocation of Resources Without Limits or Throttling in Hashicorp ConsulCVE-2020-13250fixed in 1.6.6 +1Improper Input Validation in HashiCorp ConsulCVE-2020-13170fixed in 1.6.6 +1Denial of Service (DoS) in HashiCorp ConsulCVE-2020-7219fixed in 1.6.3About Consul
Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.
Packages watched: github.com/hashicorp/consul (Go).
HashiCorp elsewhere on Ibis: Acquisitions · Paydays · Releases · Repos · TechConf