Read the docs
TI-2022-19350 Aliases CVE-2022-40716GHSA-m69r-9g56-7mv8

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for…

Priority LOW 31CWE-252Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0109 65th percentileScored 2026-11-07
Fix Partial github.com/hashicorp/consul (Go): 1.11.9, 1.12.5, 1.13.2Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/hashicorp/consul (Go)before 1.11.91.11.9Patch availableGHSA-m69r-9g56-7mv8
—github.com/hashicorp/consul (Go)1.12.0 to before 1.12.51.12.5Patch availableGHSA-m69r-9g56-7mv8
—github.com/hashicorp/consul (Go)1.13.0 to before 1.13.21.13.2Patch availableGHSA-m69r-9g56-7mv8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/hashicorp/consul (Go) Vendor— Affected before 1.11.9 Fixed in 1.11.9 Patch available GHSA-m69r-9g56-7mv8
  • github.com/hashicorp/consul (Go) Vendor— Affected 1.12.0 to before 1.12.5 Fixed in 1.12.5 Patch available GHSA-m69r-9g56-7mv8
  • github.com/hashicorp/consul (Go) Vendor— Affected 1.13.0 to before 1.13.2 Fixed in 1.13.2 Patch available GHSA-m69r-9g56-7mv8

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*before 1.11.9VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*before 1.11.9VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*1.12.0 to before 1.12.5VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*1.12.0 to before 1.12.5VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*1.13.0 to before 1.13.2VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*1.13.0 to before 1.13.2VulnerableHashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions before 1.11.9 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions before 1.11.9 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions 1.12.0 to before 1.12.5 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions 1.12.0 to before 1.12.5 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions 1.13.0 to before 1.13.2 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions 1.13.0 to before 1.13.2 Vulnerable ·HashiCorp

Remediation

  • Fix · GHSA-m69r-9g56-7mv8 github.com/hashicorp/consul (Go) Fixed in 1.11.9 Advisory →
  • Fix · GHSA-m69r-9g56-7mv8 github.com/hashicorp/consul (Go) Fixed in 1.12.5 Advisory →
  • Fix · GHSA-m69r-9g56-7mv8 github.com/hashicorp/consul (Go) Fixed in 1.13.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Not affected: 2 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-40716
  2. 2026-10-03 Alias added: GHSA-m69r-9g56-7mv8

References

Advisory 6

Other 5

  • TI-2021-18437 HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4… CVSS 3.1HIGH 8.8
  • TI-2022-11698 HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server… CVSS 3.1HIGH 7.5
  • TI-2021-02215 An issue was discovered in GoGo Protobuf before 1.3.2. CVSS 3.1HIGH 8.6
  • TI-2024-09286 Consul L7 Intentions Vulnerable To Headers Bypass CVSS 3.1HIGH 8.3
  • TI-2023-02638 Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner CVSS 3.1HIGH 8.7
  • TI-2022-03595 Consul Peering Imported Nodes/Services Leak CVSS 3.1HIGH 7.5
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences