GHSA-ccw8-7688-vqx4 BIT-consul-2021-37219 CVE-2021-37219 GO-2022-0593

HashiCorp Consul Privilege Escalation Vulnerability

High Go

Severity: 8.8 / 10; High · CVSS 3.1
Exploit chance (EPSS): 1.15%; Chance of exploitation in the next 30 days. Higher than 66.87% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-295 Improper Certificate Validation
Fix: 1.10.2; Upgrade github.com/hashicorp/consul to this version or later

Description

HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/hashicorp/consul	`>= 1.10.1, < 1.10.2`	`1.10.2`
github.com/hashicorp/consul	`>= 1.9.0, < 1.9.9`	`1.9.9`
github.com/hashicorp/consul	`< 1.8.15`	`1.8.15`
github.com/hashicorp/consul	`< 1.8.15` `>= 1.9.0, < 1.9.9` `>= 1.10.1, < 1.10.2`	`1.8.15` `1.9.9` `1.10.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/hashicorp/consul Go → `1.10.2`

go

go get github.com/hashicorp/consul@v1.10.2 && go mod tidy

Severity breakdown

CVSS 3.1 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-295: Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

How to prevent it

Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

References

Advisories

Packages

github.com/hashicorp/consul

Timeline

Sep 8, 2021 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-cpfq-66p2-336j Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication	Medium	Also affects github.com/hashicorp/consul
GHSA-qh7p-pfq3-677h Consul event endpoint is vulnerable to denial of service	Medium	Also affects github.com/hashicorp/consul
GHSA-7g3r-8c6v-hfmr Consul key/value endpoint is vulnerable to denial of service	Medium	Also affects github.com/hashicorp/consul
GHSA-99wr-c2px-grmh Hashicorp Consul Cross-site Scripting vulnerability	Medium	Also affects github.com/hashicorp/consul
GHSA-5c4w-8hhh-3c3h Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability	Medium	Also affects github.com/hashicorp/consul
GHSA-chgm-7r52-whjj Hashicorp Consul Path Traversal vulnerability	Medium	Also affects github.com/hashicorp/consul
GHSA-6m72-467w-94rh Privilege Escalation in HashiCorp Consul	Medium	Also affects github.com/hashicorp/consul
GHSA-496g-fr33-whrf Denial of service in HashiCorp Consul	High	Also affects github.com/hashicorp/consul

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor