GCVE - cpe:2.3:a:hashicorp:consul_enterprise:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:hashicorp:consul_enterprise:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Hashicorp (`dc524c16-6a01-528e-a41c-9d3e02e5e4a3`)
Product	Consul Enterprise (`b5bbeab6-a3db-58d3-b338-8ec031b5bbae`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-2808`	vulnerable	2026-06-03 15:19:25.041831	Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider MEDIUM (6.8) HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5. Published: 2026-03-11T23:08:32.414Z Updated: 2026-04-17T17:57:55.646Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2026-02-consul-vulnerable-to-arbitrary-file-reads-through-the-vault-kubernetes-authentication-provider/77232	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-11375`	vulnerable	2026-06-03 14:58:35.992075	Consul's event endpoint is vulnerable to denial of service MEDIUM (6.5) Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12. Published: 2025-10-28T20:12:14.325Z Updated: 2025-12-09T01:37:57.188Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2025-28-consuls-event-endpoint-is-vulnerable-to-denial-of-service/76723	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-11374`	vulnerable	2026-06-03 14:58:35.989966	Consul's KV endpoint is vulnerable to denial of service MEDIUM (6.5) Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12. Published: 2025-10-28T20:19:05.292Z Updated: 2026-04-17T18:34:14.829Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2025-29-consuls-kv-endpoint-is-vulnerable-to-denial-of-service/76724	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-10086`	vulnerable	2026-06-03 14:54:04.869171	Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation MEDIUM (6.1) A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS. Published: 2024-10-30T21:21:46.559Z Updated: 2025-01-10T13:06:42.658Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2024-24-consul-vulnerable-to-reflected-xss-on-content-type-error-manipulation	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-10006`	vulnerable	2026-06-03 14:54:04.677640	Consul L7 Intentions Vulnerable To Headers Bypass HIGH (8.3) A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules. Published: 2024-10-30T21:20:37.011Z Updated: 2025-01-10T13:06:41.296Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-10005`	vulnerable	2026-06-03 14:54:04.675765	Consul L7 Intentions Vulnerable To URL Path Bypass HIGH (8.1) A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules. Published: 2024-10-30T21:19:22.576Z Updated: 2025-01-10T13:06:39.935Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-3518`	vulnerable	2026-06-03 14:52:41.055488	JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access HIGH (7.4) HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1. Published: 2023-08-09T15:06:52.406Z Updated: 2024-10-08T14:56:28.934Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2023-25-consul-jwt-auth-in-l7-intentions-allow-for-mismatched-service-identity-and-jwt-providers/57004	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2816`	vulnerable	2026-06-03 14:51:44.070816	Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner HIGH (8.7) Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies. Published: 2023-06-02T22:43:34.553Z Updated: 2024-10-07T20:12:01.627Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2023-16-consul-envoy-extension-downstream-proxy-configuration-by-upstream-service-owner/54525	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-1297`	vulnerable	2026-06-03 14:48:54.240241	Consul Cluster Peering can Result in Denial of Service MEDIUM (4.9) Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3 Published: 2023-06-02T22:48:28.938Z Updated: 2025-01-08T17:51:02.037Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2023-15-consul-cluster-peering-can-result-in-denial-of-service/54515	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-0845`	vulnerable	2026-06-03 14:48:52.974163	Consul Server Panic when Ingress and API Gateways Configured with Peering MEDIUM (4.9) Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5. Published: 2023-03-09T15:14:26.581Z Updated: 2025-02-28T16:24:23.430Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2023-06-consul-server-panic-when-ingress-and-api-gateways-configured-with-peering-connections/51197 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-3920`	vulnerable	2026-06-03 14:47:59.550326	Consul Peering Imported Nodes/Services Leak MEDIUM (5.3) HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0. Published: 2022-11-15T23:25:30.161Z Updated: 2025-04-29T20:02:00.547Z Open on db.gcve.eu Reference links https://discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.