Read the docs
TI-2021-16269 Aliases CVE-2021-38698GHSA-6hw5-6gcx-phmw

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to…

Priority LOW 32CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

Why it matters now

EPSS 0.01423 73rd percentileScored 2026-11-07
Fix Fixed github.com/hashicorp/consul (Go): 1.10.2, 1.9.9, 1.8.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/hashicorp/consul (Go)1.10.1 to before 1.10.21.10.2Patch availableGHSA-6hw5-6gcx-phmw
—github.com/hashicorp/consul (Go)1.9.0 to before 1.9.91.9.9Patch availableGHSA-6hw5-6gcx-phmw
—github.com/hashicorp/consul (Go)before 1.8.151.8.15Patch availableGHSA-6hw5-6gcx-phmw
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/hashicorp/consul (Go) Vendor— Affected 1.10.1 to before 1.10.2 Fixed in 1.10.2 Patch available GHSA-6hw5-6gcx-phmw
  • github.com/hashicorp/consul (Go) Vendor— Affected 1.9.0 to before 1.9.9 Fixed in 1.9.9 Patch available GHSA-6hw5-6gcx-phmw
  • github.com/hashicorp/consul (Go) Vendor— Affected before 1.8.15 Fixed in 1.8.15 Patch available GHSA-6hw5-6gcx-phmw

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*before 1.8.15VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*before 1.8.15VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*1.9.0 to before 1.9.9VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*1.9.0 to before 1.9.9VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*1.10.0 to before 1.10.2VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*1.10.0 to before 1.10.2VulnerableHashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions before 1.8.15 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions before 1.8.15 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions 1.9.0 to before 1.9.9 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions 1.9.0 to before 1.9.9 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions 1.10.0 to before 1.10.2 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions 1.10.0 to before 1.10.2 Vulnerable ·HashiCorp

Remediation

  • Fix · GHSA-6hw5-6gcx-phmw github.com/hashicorp/consul (Go) Fixed in 1.10.2 Advisory →
  • Fix · GHSA-6hw5-6gcx-phmw github.com/hashicorp/consul (Go) Fixed in 1.9.9 Advisory →
  • Fix · GHSA-6hw5-6gcx-phmw github.com/hashicorp/consul (Go) Fixed in 1.8.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38698
  2. 2026-10-03 Alias added: GHSA-6hw5-6gcx-phmw

References

Advisory 4

Other 2

  • TI-2021-18437 HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4… CVSS 3.1HIGH 8.8
  • TI-2022-11698 HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server… CVSS 3.1HIGH 7.5
  • TI-2021-02215 An issue was discovered in GoGo Protobuf before 1.3.2. CVSS 3.1HIGH 8.6
  • TI-2024-09286 Consul L7 Intentions Vulnerable To Headers Bypass CVSS 3.1HIGH 8.3
  • TI-2023-02638 Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner CVSS 3.1HIGH 8.7
  • TI-2022-03595 Consul Peering Imported Nodes/Services Leak CVSS 3.1HIGH 7.5
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences