Consul Enterprise
Monthly
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communicate with destination services it is not authorized to reach. The flaw originates in Consul's Envoy RBAC rule generation: unescaped special characters in service names, namespaces, or partitions cause the generated matching rules to be overly permissive, defeating the Connect intentions authorization model. No public exploit or CISA KEV listing exists at time of analysis; fixes are available across Consul open-source and Enterprise release trains.
Authorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-write token-scoped to any node name whatsoever-to delete a different node's catalog registration and seize that node's identity within the service mesh. All Consul open-source and Enterprise versions prior to the fixed releases are affected, making shared or multi-tenant Consul clusters with delegated node-write tokens particularly exposed. No public exploit code or active exploitation has been identified at time of analysis, but the low access complexity and the typically discoverable nature of node IDs make this a credible lateral-movement and disruption vector in production service-mesh deployments.
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent file descriptors, goroutines, and memory by flooding incomplete connections, rendering the agent unreachable to legitimate clients. Both Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 are affected - a span covering nearly three years of releases. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 7.5 score and AV:N/AC:L/PR:N profile reflect a straightforwardly exploitable network condition requiring no attacker authentication or user interaction.
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete services, checks, or nodes that were imported from a peered cluster without holding authority over that peer origin. Affecting Consul through 2.0.3 and Consul Enterprise through 1.21.17/1.22.11/2.0.3, any ACL token holder with `service:write` or `node:write` permissions can exploit the missing peer-origin authority check (CWE-863) to disrupt service discovery across cluster peering relationships. No public exploit code exists and this is not in CISA KEV; the CVSS 5.4 Medium score correctly reflects the real constraint of requiring a valid low-privileged ACL token and an active peering configuration.
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a valid mTLS certificate - but no ACL token - to crash or severely degrade Consul servers by exhausting server memory before ACL authorization is evaluated. Both open-source Consul and Consul Enterprise are affected across multiple release tracks. Vendor-released patches are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4; no public exploit or CISA KEV listing has been identified at time of analysis.
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to force the agent to allocate substantial memory before a request is finally rejected. Both Community Edition and Enterprise versions 1.3.0 through 2.0.2 are affected, covering a multi-year release window. No public exploit has been identified and the vulnerability is absent from CISA KEV, but the zero-authentication, low-complexity network attack path makes it straightforward to trigger for any attacker with network access to the Consul agent API port.
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an authenticated mesh workload to reach HTTP paths that are explicitly blocked by path-based deny intentions, when the service proxy is configured with a custom public listener. The flaw undermines a core service mesh security control - path-based L7 intentions - without requiring unauthenticated access or elevated privileges beyond mesh workload enrollment. No public exploit code has been identified and this CVE is not listed in CISA KEV; the CVSS 4.2 Medium score accurately reflects the configuration-dependent, authenticated nature of the attack.
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-accessible, highly-privileged attacker to exfiltrate sensitive credential files from the Consul server host. The flaw is scoped to configurations using the Vault Connect CA provider with JWT or AppRole authentication - a non-default but production-relevant deployment pattern - and requires operator:write permission to exploit. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in Consul 2.0.3 and corresponding Enterprise builds.
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expand the agent's Connect CA roots cache indefinitely, overriding any operator-applied cache-disable configuration. Both Consul Community Edition and Consul Enterprise are affected from version 1.2.0 through 2.0.2. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 5.3 Medium rating reflects limited availability impact with no confidentiality or integrity exposure.
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated network callers to unboundedly inflate the Consul agent's intention-match cache via the Connect authorization endpoint, defeating explicitly configured cache-disable operator settings. This CWE-770 flaw degrades service mesh authorization availability and undermines a deliberate operational control. No public exploit code or active exploitation has been identified; HashiCorp has released patches across all affected release lines.
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a network attacker holding config-entry write permission to crash the Consul server agent by submitting a crafted service-router configuration entry. The flaw is rooted in a null pointer dereference (CWE-476) triggered along the Enterprise-to-Community Edition downgrade code path, meaning only deployments undergoing or having undergone that transition are exploitable. No public exploit code or active exploitation confirmed by CISA KEV has been identified; vendor-released patches are available and confirmed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated callers to delete arbitrary sessions via the transaction API without holding the required `session:write` ACL permission. Any principal with valid credentials and network access to the Consul server's API can silently circumvent access controls that are correctly enforced on the standard session deletion endpoint. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low privilege barrier and straightforward API path make targeted misuse plausible in multi-tenant or shared Consul deployments.
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communicate with destination services it is not authorized to reach. The flaw originates in Consul's Envoy RBAC rule generation: unescaped special characters in service names, namespaces, or partitions cause the generated matching rules to be overly permissive, defeating the Connect intentions authorization model. No public exploit or CISA KEV listing exists at time of analysis; fixes are available across Consul open-source and Enterprise release trains.
Authorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-write token-scoped to any node name whatsoever-to delete a different node's catalog registration and seize that node's identity within the service mesh. All Consul open-source and Enterprise versions prior to the fixed releases are affected, making shared or multi-tenant Consul clusters with delegated node-write tokens particularly exposed. No public exploit code or active exploitation has been identified at time of analysis, but the low access complexity and the typically discoverable nature of node IDs make this a credible lateral-movement and disruption vector in production service-mesh deployments.
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent file descriptors, goroutines, and memory by flooding incomplete connections, rendering the agent unreachable to legitimate clients. Both Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 are affected - a span covering nearly three years of releases. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 7.5 score and AV:N/AC:L/PR:N profile reflect a straightforwardly exploitable network condition requiring no attacker authentication or user interaction.
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete services, checks, or nodes that were imported from a peered cluster without holding authority over that peer origin. Affecting Consul through 2.0.3 and Consul Enterprise through 1.21.17/1.22.11/2.0.3, any ACL token holder with `service:write` or `node:write` permissions can exploit the missing peer-origin authority check (CWE-863) to disrupt service discovery across cluster peering relationships. No public exploit code exists and this is not in CISA KEV; the CVSS 5.4 Medium score correctly reflects the real constraint of requiring a valid low-privileged ACL token and an active peering configuration.
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a valid mTLS certificate - but no ACL token - to crash or severely degrade Consul servers by exhausting server memory before ACL authorization is evaluated. Both open-source Consul and Consul Enterprise are affected across multiple release tracks. Vendor-released patches are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4; no public exploit or CISA KEV listing has been identified at time of analysis.
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to force the agent to allocate substantial memory before a request is finally rejected. Both Community Edition and Enterprise versions 1.3.0 through 2.0.2 are affected, covering a multi-year release window. No public exploit has been identified and the vulnerability is absent from CISA KEV, but the zero-authentication, low-complexity network attack path makes it straightforward to trigger for any attacker with network access to the Consul agent API port.
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an authenticated mesh workload to reach HTTP paths that are explicitly blocked by path-based deny intentions, when the service proxy is configured with a custom public listener. The flaw undermines a core service mesh security control - path-based L7 intentions - without requiring unauthenticated access or elevated privileges beyond mesh workload enrollment. No public exploit code has been identified and this CVE is not listed in CISA KEV; the CVSS 4.2 Medium score accurately reflects the configuration-dependent, authenticated nature of the attack.
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-accessible, highly-privileged attacker to exfiltrate sensitive credential files from the Consul server host. The flaw is scoped to configurations using the Vault Connect CA provider with JWT or AppRole authentication - a non-default but production-relevant deployment pattern - and requires operator:write permission to exploit. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in Consul 2.0.3 and corresponding Enterprise builds.
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expand the agent's Connect CA roots cache indefinitely, overriding any operator-applied cache-disable configuration. Both Consul Community Edition and Consul Enterprise are affected from version 1.2.0 through 2.0.2. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 5.3 Medium rating reflects limited availability impact with no confidentiality or integrity exposure.
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated network callers to unboundedly inflate the Consul agent's intention-match cache via the Connect authorization endpoint, defeating explicitly configured cache-disable operator settings. This CWE-770 flaw degrades service mesh authorization availability and undermines a deliberate operational control. No public exploit code or active exploitation has been identified; HashiCorp has released patches across all affected release lines.
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a network attacker holding config-entry write permission to crash the Consul server agent by submitting a crafted service-router configuration entry. The flaw is rooted in a null pointer dereference (CWE-476) triggered along the Enterprise-to-Community Edition downgrade code path, meaning only deployments undergoing or having undergone that transition are exploitable. No public exploit code or active exploitation confirmed by CISA KEV has been identified; vendor-released patches are available and confirmed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated callers to delete arbitrary sessions via the transaction API without holding the required `session:write` ACL permission. Any principal with valid credentials and network access to the Consul server's API can silently circumvent access controls that are correctly enforced on the standard session deletion endpoint. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low privilege barrier and straightforward API path make targeted misuse plausible in multi-tenant or shared Consul deployments.