Malicious code in consul-partitions (npm)

The package consul-partitions was found to contain malicious code...

MAL-2025-17502 Malicious code in consul-lock-sessions (npm)

The package consul-lock-sessions was found to contain malicious code...

Malicious code in consul-hcp (npm)

The package consul-hcp was found to contain malicious code...

Malicious code in consul-peerings (npm)

The package consul-peerings was found to contain malicious code...

Malicious code in consul-acls (npm)

The package consul-acls was found to contain malicious code...

MAL-2025-17504 Malicious code in consul-peerings (npm)

The package consul-peerings was found to contain malicious code...

MAL-2025-17501 Malicious code in consul-hcp (npm)

The package consul-hcp was found to contain malicious code...

MAL-2025-17503 Malicious code in consul-partitions (npm)

The package consul-partitions was found to contain malicious code...

The vulnerability of the Consul and Consul Enterprise service configuration tool, related to the disclosure of information, allows a perpetrator to access potentially confidential information.

The vulnerability of the Consul and Consul Enterprise service configuration tool is related to the disclosure of information. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to potentially confidential information...

The vulnerability of the Consul and Consul Enterprise service configuration tool, related to unvalidated returned values, allows attackers to circumvent established security restrictions.

The vulnerability of the Consul and Consul Enterprise service configuration tool is related to an unvalidated returned value. Exploiting this vulnerability allows a malicious actor to bypass established security restrictions from a remote location...

SUSE CVE-2025-48865

Fabio is an HTTPS and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers except X-Forwarded-For due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and...

ROS-20250624-05

A vulnerability in the Consul and Consul Enterprise service configuration tool is related to errors in the processing of CSR requests at the RPC endpoint. Exploitation of the vulnerability could allow an attacker acting remotely to bypass the implemented security restrictions. remotely to bypass...

CVE-2023-3518

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...

CVE-2023-30530

Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2023-2816

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the services corresponding to those...

CVE-2023-30531

Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2022-24687

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3...

CVE-2021-36213

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

CVE-2021-41805

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token with the default operator:write permissions in one namespace can be used for unintended privilege escalation in a different namespace...