consul vulnerabilities and fixes

Recent CVEs affecting consul, with upgrade or downgrade steps. 36 tracked.

consul has 36 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 34. Most recent: 2025-10-28. Highest priority: CVE-2019-16377 (score 66/100).

• CVE-2025-11374 MEDIUM 6.5 UPGRADE Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to i
• CVE-2025-11375 MEDIUM 6.5 UPGRADE Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack
• CVE-2024-10086 MEDIUM 6.1 UPGRADE A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitl
• CVE-2024-10006 HIGH 8.3 UPGRADE A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffi
• CVE-2024-10005 HIGH 8.1 UPGRADE A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traf
• CVE-2023-5332 MEDIUM 5.9 UPGRADE UPGRADE Patch in third party library Consul requires 'enable-script-checks' to be set to False
• CVE-2023-3518 HIGH 7.4 DOWNGRADE HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies a
• CVE-2023-2816 HIGH 8.7 UPGRADE Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configure
• CVE-2023-1297 MEDIUM 4.9 UPGRADE Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with ser
• CVE-2023-0845 MEDIUM 4.9 UPGRADE Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflo
• CVE-2022-40716 MEDIUM 6.5 UPGRADE HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI valu
• CVE-2022-3920 MEDIUM 5.3 UPGRADE HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes an
• CVE-2022-29153 HIGH 7.5 UPGRADE MITIGATE HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery
• CVE-2022-24687 MEDIUM 6.5 UPGRADE HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ing
• CVE-2021-41805 HIGH 8.8 UPGRADE HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access
• CVE-2021-41803 HIGH 7.1 UPGRADE HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names pri
• CVE-2021-3121 HIGH 8.6 UPGRADE UPGRADE An issue was discovered in GoGo Protobuf before 1.3.2
• CVE-2021-38698 MEDIUM 6.5 UPGRADE HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for othe
• CVE-2021-37219 HIGH 8.8 UPGRADE HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate
• CVE-2021-36213 HIGH 7.5 UPGRADE HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-a
• CVE-2021-32574 HIGH 7.5 UPGRADE HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate de
• CVE-2021-28156 HIGH 7.5 UPGRADE HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP e
• CVE-2020-7955 MEDIUM 5.3 UPGRADE HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpo
• CVE-2020-7219 HIGH 7.5 UPGRADE HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and wer
• CVE-2020-28053 MEDIUM 6.5 UPGRADE HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions
• CVE-2020-25864 MEDIUM 6.1 UPGRADE HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-sit
• CVE-2020-25201 HIGH 7.5 UPGRADE HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be trigge
• CVE-2020-13250 HIGH 7.5 UPGRADE HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3)
• CVE-2020-13170 HIGH 7.5 UPGRADE HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primar
• CVE-2020-12797 MEDIUM 5.3 UPGRADE HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagat
• CVE-2020-12758 HIGH 7.5 UPGRADE HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router en
• CVE-2019-9764 HIGH 7.4 DOWNGRADE HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication
• CVE-2019-8336 HIGH 8.1 UPGRADE HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrict
• CVE-2019-16377 CRITICAL 9.8 UPGRADE The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.
• CVE-2019-12291 HIGH 7.5 UPGRADE HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control
• CVE-2018-19653 MEDIUM 5.9 UPGRADE HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_out

FAQ

How do I fix consul vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is consul being exploited right now?

None of the tracked consul CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which consul CVE should I patch first?

CVE-2019-16377 currently ranks highest (66/100): The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control..

RSS feed for consul · ← Back to latest CVEs