HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions

HIGH 7.1CVE-2021-41803 · BIT-consul-2021-41803 · GHSA-hr3v-8cp3-68rf · Published 23/09/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/hashicorp/consul Go	`≥ 1.12.0, < 1.12.5≥ 1.13.0, < 1.13.2≥ 1.8.1, < 1.11.9`	`1.12.51.13.21.11.9`
consul hashicorp	`= 1.12.4= 1.13.1≥ 1.8.1, < 1.11.9`	`1.11.9`

Description

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.

NVD description

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free