Missing Authorization in HashiCorp Consul

HIGH 7.5CVE-2022-3920 · BIT-consul-2022-3920 · GHSA-gw2g-hhc9-wgjh · Published 16/11/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/hashicorp/consul Go	`≥ 1.13.0, < 1.14.0`	`1.14.0`
consul hashicorp	`≥ 1.13.0, ≤ 1.13.3`	No fix yet

Description

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

NVD description

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

References

nvd.nist.gov/vuln/detail/CVE-2022-3920 · ADVISORY
hashicorp/consul commit 706866f · WEB
discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946 · WEB
GitHub Advisory GHSA-gw2g-hhc9-wgjh · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free