Read the docs
TI-2024-09286 Aliases CVE-2024-10006GHSA-5c4w-8hhh-3c3h

Consul L7 Intentions Vulnerable To Headers Bypass

Priority MEDIUM 42CWE-644Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Fix Fixed Consul (HashiCorp): 1.20.1Consul Enterprise (HashiCorp): 1.20.1+1 more productRed Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HashiCorpConsul1.9.0 to before 1.20.11.20.1Patch availableCNA
HashiCorpConsul Enterprise1.9.0 to before 1.20.11.20.1Patch availableCNA
—github.com/hashicorp/consul (Go)1.9.0 to before 1.20.11.20.1Patch availableGHSA-5c4w-8hhh-3c3h
  • Consul VendorHashiCorp Affected 1.9.0 to before 1.20.1 Fixed in 1.20.1 Patch available CNA
  • Consul Enterprise VendorHashiCorp Affected 1.9.0 to before 1.20.1 Fixed in 1.20.1 Patch available CNA
  • github.com/hashicorp/consul (Go) Vendor— Affected 1.9.0 to before 1.20.1 Fixed in 1.20.1 Patch available GHSA-5c4w-8hhh-3c3h

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:hashicorp:consul:*:*:*:*:community:*:*:*1.4.1 to before 1.20.1VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*1.9.0 to before 1.15.15; 1.18.0 to before 1.18.5; 1.19.0 to before 1.19.3VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:1.20.0:*:*:*:enterprise:*:*:*1.20.0VulnerableHashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:community:*:*:* Versions 1.4.1 to before 1.20.1 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions 1.9.0 to before 1.15.15; 1.18.0 to before 1.18.5; 1.19.0 to before 1.19.3 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:1.20.0:*:*:*:enterprise:*:*:* Versions 1.20.0 Vulnerable ·HashiCorp

Remediation

  • Fix · CNA Consul (HashiCorp) Fixed in 1.20.1
  • Fix · CNA Consul Enterprise (HashiCorp) Fixed in 1.20.1
  • Fix · GHSA-5c4w-8hhh-3c3h github.com/hashicorp/consul (Go) Fixed in 1.20.1 Advisory →

Red Hat 1 advisory

  • RHSA-2025:15847 Released 2025-09-15 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.23.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/machineexec-rhel9 +3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    HashiCorp Consul, Consul Enterprise 1.20.1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-09285 Consul L7 Intentions Vulnerable To URL Path BypassPriority LOW 39
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Dev Spaces (RHOSDS) 3.23Fixed RHSA-2025:15847
Not affected: 1 product
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10006
  2. 2026-10-03 Alias added: GHSA-5c4w-8hhh-3c3h

References

Advisory 2

Other 4

  • TI-2021-18437 HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4… CVSS 3.1HIGH 8.8
  • TI-2022-11698 HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server… CVSS 3.1HIGH 7.5
  • TI-2021-02215 An issue was discovered in GoGo Protobuf before 1.3.2. CVSS 3.1HIGH 8.6
  • TI-2023-02638 Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner CVSS 3.1HIGH 8.7
  • TI-2022-03595 Consul Peering Imported Nodes/Services Leak CVSS 3.1HIGH 7.5
  • TI-2021-15279 HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents… CVSS 3.1HIGH 8.8
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences