Read the docs
TI-2023-02638 Aliases CVE-2023-2816GHSA-rqjq-ww83-wv5c

Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner

Priority MEDIUM 40CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-266.

Summary

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00585 48th percentileScored 2026-11-07
Fix Fixed github.com/hashicorp/consul (Go): 1.15.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HashiCorpConsul1.15.0; 1.15.1; 1.15.2—No fix listedCNA
HashiCorpConsul Enterprise1.15.0; 1.15.1; 1.15.2—No fix listedCNA
—github.com/hashicorp/consul (Go)1.15.0 to before 1.15.31.15.3Patch availableGHSA-rqjq-ww83-wv5c
  • Consul VendorHashiCorp Affected 1.15.0; 1.15.1; 1.15.2 Fixed in — No fix listed CNA
  • Consul Enterprise VendorHashiCorp Affected 1.15.0; 1.15.1; 1.15.2 Fixed in — No fix listed CNA
  • github.com/hashicorp/consul (Go) Vendor— Affected 1.15.0 to before 1.15.3 Fixed in 1.15.3 Patch available GHSA-rqjq-ww83-wv5c

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*1.15.0 to before 1.15.3VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*1.15.0 to before 1.15.3VulnerableHashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions 1.15.0 to before 1.15.3 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions 1.15.0 to before 1.15.3 Vulnerable ·HashiCorp

Remediation

  • Fix · GHSA-rqjq-ww83-wv5c github.com/hashicorp/consul (Go) Fixed in 1.15.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2816
  2. 2026-10-03 Alias added: GHSA-rqjq-ww83-wv5c

References

Advisory 2

Other 1

  • TI-2021-18437 HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4… CVSS 3.1HIGH 8.8
  • TI-2022-11698 HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server… CVSS 3.1HIGH 7.5
  • TI-2021-02215 An issue was discovered in GoGo Protobuf before 1.3.2. CVSS 3.1HIGH 8.6
  • TI-2024-09286 Consul L7 Intentions Vulnerable To Headers Bypass CVSS 3.1HIGH 8.3
  • TI-2022-03595 Consul Peering Imported Nodes/Services Leak CVSS 3.1HIGH 7.5
  • TI-2021-15279 HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents… CVSS 3.1HIGH 8.8
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences