reproxy

Reproxy est un serveur edge HTTPs / proxy inverse simple supportant divers fournisseurs docker, static, file, consul catalog. Un ou plusieurs fournisseurs fournissent des informations sur le serveur demandé, l'URL demandée, l'URL de destination et l'URL de vérification de santé. Il est distribué...

CVE-2021-41805

CVE-2021-41805 Hashicorp Consul RCE via l'API HashiCorp Consul Enterprise avant 1.8.17, 1.9.x avant 1.9.11, et 1.10.x avant 1.10.4 présente un contrôle d'accès incorrect. Un jeton ACL avec les permissions par défaut operator:write dans un espace de noms peut être utilisé pour une escalade de...

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data,...

HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting

HashiCorp Consul and Consul Enterprise up to version 1.9.4 are vulnerable to cross-site scripting via the key-value KV raw mode. id: CVE-2020-25864 info: name: HashiCorp Consul/Consul Enterprise =1.9.4 - Cross-Site Scripting author: c-sh0 severity: medium description: | HashiCorp Consul and Consu...

CLEANSTART-2026-ED72933 html

Security vulnerability affects the consul package. The html...

CLEANSTART-2026-OZ83684 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

Security vulnerability affects the consul package. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption...

CLEANSTART-2026-HZ65290 Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header

Security vulnerability affects the consul package. Consul and Consul Enterprise’s “Consul” event endpoint is vulnerable to denial of service DoS due to lack of maximum value on the Content Length header...

CLEANSTART-2026-RO22308 (*x509

Security vulnerability affects the consul package. x509...

CLEANSTART-2026-TQ62696 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the consul package. gRPC-Go is the Go language implementation of gRPC...

CVE-2026-5061

CVE-2026-5061 Consul Template проверял, куда указывает символическая ссылка во время вычисления шаблона, но последующее получение зависимости читало исходный путь. Перенацеливание ссылки между этими операциями превращало ссылку на файл внутри песочницы в раскрытие файла за её пределами. Введение ...

CVE-2026-27172

camel-consul ConsulRegistry – Reproducteur de la vulnérabilité de désérialisation CVE-2026-27172 Ce projet démontre une vulnérabilité de désérialisation Java dans le composant camel-consul d'Apache Camel ConsulRegistry, référencée sous le nom CVE-2026-27172. Il s'agit du même type de problème que...

CVE-2026-14361

CVE-2026-14361 Помощник writeToFile в Consul Template открывал указанное оператором место назначения напрямую и следовал по связанным компонентам пути, позволяя отрисованному выводу выйти за пределы задуманного каталога и перезаписать существующий файл. Intro Я нашёл эту проблему при анализе...

CVE-2021-41805

CVE-2021-41805 - HashiCorp Consul Enterprise RCE !WARNING AVIS JURIDIQUE : Cet outil est STRICTEMENT réservé à des FINS ÉDUCATIVES UNIQUEMENT ! L'utilisation de cet outil pour attaquer des cibles sans consentement mutuel préalable est ILLÉGALE. Il est de la responsabilité de l'utilisateur de...

BIT-CONSUL-2026-88021 Consul vulnerable to an authorization bypass in the Connect service mesh

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in...

BIT-CONSUL-2026-87993 Consul-template vulnerable to an information disclosure issue in error handling

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

BIT-CONSUL-2026-87107 Consul vulnerable to an authorization bypass in the catalog deregistration path

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with service:write or node:write permission may exploit this issue to remove services, checks, or nodes...

BIT-CONSUL-2026-87106 Consul vulnerable to a denial of service in the native RPC listener

Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a...

BIT-CONSUL-2026-87090 Consul vulnerable to an authorization bypass in the catalog node-write path

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987

Fabio (an HTTP/S and TCP router for Consul-managed applications) versions 1.6.6 through 1.7.2 contain an incomplete fix for CVE-2025-48865 . The protectHeaders logic in proxy/http_headers.go covers a hardcoded set of forwarded headers but omits operator-configured ClientIPHeader , TLSHeader , and...