CVE-2021-38698: HashiCorp Consul and Consul Enterprise Proxy Registration Vulnerability
Summary
CVE-2021-38698: HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Affects github.com/hashicorp/consul across 3 version ranges.
< 1.8.15
>= 1.9.0, < 1.9.9
>= 1.10.1, < 1.10.2
Fixed in 1.8.15, 1.9.9 or 1.10.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-38698 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
HashiCorp Consul is an open-source service mesh solution that provides a distributed, highly available, and scalable platform for service discovery, configuration, and segmentation across various infrastructure environments. Consul Enterprise is the commercial version of Consul, offering additional features and support. This vulnerability affects Consul and Consul Enterprise versions 1.8.15, 1.9.9, and 1.10.2.
Vulnerability Detail
The vulnerability (CVE-2021-38698) in HashiCorp Consul and Consul Enterprise versions 1.10.1 and below allows services to register proxies for other services, granting unauthorized access to service traffic. This means that an attacker could exploit this vulnerability to intercept and manipulate service traffic, potentially leading to data breaches, unauthorized access, or service disruption. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: v1.22.7 as of 22 Oct 2026
go get github.com/hashicorp/consul@v1.22.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.8.151.8.15go get github.com/hashicorp/consul@v1.8.15 -
>= 1.9.0, < 1.9.91.9.9go get github.com/hashicorp/consul@v1.9.9 -
>= 1.10.1, < 1.10.21.10.2go get github.com/hashicorp/consul@v1.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the fixed versions of HashiCorp Consul or Consul Enterprise.
Conclusion
The vulnerability in HashiCorp Consul and Consul Enterprise versions 1.10.1 and below allows unauthorized proxy registration, enabling access to service traffic. It is crucial to upgrade to the fixed versions (1.8.15, 1.9.9, or 1.10.2) to mitigate the risk of unauthorized access and potential data breaches. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/consul →
FAQ
This vulnerability allows unauthorized access to service traffic, which can lead to data breaches, unauthorized access, or service disruption.
Users of HashiCorp Consul and Consul Enterprise versions 1.10.1 and below are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, HashiCorp has released fixed versions of Consul and Consul Enterprise. It is recommended to upgrade to the respective fixed versions.
You can find more information about this vulnerability in the HashiCorp Consul advisory on the GitHub Advisory Database.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/consul.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
