CVE-2021-41805

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token with the default operator:write permissions in one namespace can be used for unintended privilege escalation in a different namespace...

Consul Enterprise Namespace Default ACLs Allow Privilege Escalation

Summary A vulnerability was identified in Consul Enterprise such that an ACL token with the default operator:write permissions in one namespace may be used to escalate privileges into any other permissions across all namespaces. This vulnerability, CVE-2021-41805, was fixed in Consul Enterprise...