CVE-2026-14361

CVE-2026-14361 Consul Template's writeToFile helper opened an operator-supplied destination directly and followed linked path components, allowing rendered output to escape the intended directory and overwrite a preexisting file. Intro I found this issue while reviewing HashiCorp Consul Template ...

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data,...

HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting

HashiCorp Consul and Consul Enterprise up to version 1.9.4 are vulnerable to cross-site scripting via the key-value KV raw mode. id: CVE-2020-25864 info: name: HashiCorp Consul/Consul Enterprise =1.9.4 - Cross-Site Scripting author: c-sh0 severity: medium description: | HashiCorp Consul and Consu...

CVE-2021-41805

CVE-2021-41805 Hashicorp Consul RCE via API HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token with the default operator:write permissions in one namespace can be used for unintended privilege escalation in a differe...

CVE-2026-5061

CVE-2026-5061 Consul Template validated where a symlink pointed during template evaluation, but its later dependency fetch read the original path. Retargeting the link between those operations turned an in-sandbox file reference into an out-of-sandbox file disclosure. Intro I found this issue whi...

CVE-2026-27172

camel-consul ConsulRegistry Deserialization Vulnerability Reproducer CVE-2026-27172 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-consul component ConsulRegistry, tracked as CVE-2026-27172. It is the same class of issue as CVE-2024-22369 , CVE-2024-23114 a...

CVE-2021-41805

CVE-2021-41805 - HashiCorp Consul Enterprise RCE !WARNING LEGAL DISCLAIMER: This tool is STRICTLY for EDUCATIONAL PURPOSES ONLY! Usage of this tool for attacking targets without prior mutual consent is ILLEGAL. It is the user's responsibility to obey all laws that apply whilst using this tool. Th...

GHSA-3RQQ-8XJM-V58X vulnerabilities

Vulnerabilities for packages: consul-fips, consul...

CVE-2026-110720 vulnerabilities

Vulnerabilities for packages: consul-fips, consul...

SUSE CVE-2026-115804

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability CVE-2026-115804 is fixed in Consul Community Edition 2.1.0 a...

CVE-2026-105608

A flaw was found in HashiCorp Consul. An authenticated user with service write permissions can bypass authorization controls during service mesh proxy registration. By applying custom Envoy proxy configurations without possessing required mesh write privileges, an attacker can alter proxy setting...

CVE-2026-105626

A flaw was found in HashiCorp Consul. An unauthenticated remote attacker can exploit this vulnerability through the HTTP Application Programming Interface API to cause excessive memory consumption on a Consul agent. Successful exploitation leads to memory exhaustion and results in a Denial of...

CVE-2026-105765

A flaw was found in HashiCorp Consul. An authorization bypass vulnerability in the agent's service mesh leaf certificate API allows an attacker without a valid Access Control List ACL token to retrieve cached service leaf certificates along with their private keys. This could enable an unauthoriz...

CLEANSTART-2026-SR85719 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

Security vulnerability affects the consul package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

CLEANSTART-2026-DV70438 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the consul package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CLEANSTART-2026-KJ72444 Security fix for GHSA-78h2-9frx-2jm8 applied in: consul 1.22.5-r0, step-cli 0.28.7-r3, grafana 12.4.3-r2, minio 0.20251015.172955-r2, grafana-fips 12.2.8-r0, loki 3.6.10-r1

GHSA-78h2-9frx-2jm8 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WQ89744 Security fix for GHSA-mh2q-q3fh-2475 applied in: consul 1.22.7-r0, consul 1.22.7-r2, gatekeeper 3.20.1-r1, gatekeeper-fips 3.20.1-r1, minio 0.20251015.172955-r2, gcp-compute-persistent-disk-csi-driver-fips 1.25.0-r0

GHSA-mh2q-q3fh-2475 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OS27290 Security fix for GHSA-p77j-4mvh-x3m3 applied in: consul 1.22.5-r1, gatekeeper 3.20.1-r1, gatekeeper-fips 3.20.1-r1, minio 0.20251015.172955-r1, gcp-compute-persistent-disk-csi-driver-fips 1.25.0-r0

GHSA-p77j-4mvh-x3m3 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MR03784 Security fix for GHSA-vh4v-2xq2-g5cg applied in: opentofu 1.11.13-r1, opentofu 1.11.13-r2, opentofu 1.11.13-r3, consul-k8s 2.0.1-r1, consul-k8s 2.0.1-r2, consul-k8s 2.0.1-r3, trivy 0.69.3-r3

GHSA-vh4v-2xq2-g5cg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GD15300 Security fix for GHSA-259r-337f-4rfw applied in: consul-k8s 1.7.13-ri3, etcd 3.6.14-r1, traefik 3.4.5-r0, traefik 3.7.6-r2, step-cli 0.28.7-r3, thanos 0.42.3-r1, thanos 0.42.3-r2, thanos 0.42.4-r0, nats-server 2.14.3-r0, consul-k8s 1.7.13-r3, grafana 13.0.3-r2, etcd 3.6.13-r1

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...