Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers

HIGH 7.3CVE-2023-3518 · BIT-consul-2023-3518 · GHSA-9rhf-q362-77mx · Published 09/08/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/hashicorp/consul Go	`≥ 1.16.0, < 1.16.1`	`1.16.1`
consul hashicorp	`= 1.16.0`	No fix yet

Description

A vulnerability was identified in Consul such that using JWT authentication for service mesh incorrectly allows/denies access regardless of service identities. This vulnerability, CVE-2023-3518, affects Consul 1.16.0 and was fixed in 1.16.1.

NVD description

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

References

nvd.nist.gov/vuln/detail/CVE-2023-3518 · ADVISORY
discuss.hashicorp.com/t/hcsec-2023-25-consul-jwt-auth-in-l7-intentions-allow-for-mismatched-service-identity-and-jwt-providers/57004 · WEB
hashicorp/consul · PACKAGE
GitHub Advisory GHSA-9rhf-q362-77mx · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free