Consul vulnerable to partial arbitrary file read via Vault Connect CA provider

Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider

Consul vulnerable to a denial of service in the native RPC listener

Consul's KV endpoint is vulnerable to denial of service

Consul's event endpoint is vulnerable to denial of service

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target…

Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain…

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of…

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a…

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration

Consul vulnerable to an authorization bypass in health check registration

Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented

Consul L7 Intentions Vulnerable To Headers Bypass

Consul L7 Intentions Vulnerable To URL Path Bypass

Consul vulnerable to an authorization bypass in the catalog deregistration path

Unauthenticated denial of service via unbounded request body processing

Uncontrolled resource consumption in the Consul Connect CA roots endpoint

Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure

Uncontrolled resource consumption in the Consul Connect authorization endpoint

L7 intention authorization bypass via custom public listener

Authorization bypass for session deletion in the transaction API