Proxy Registration Vulnerability in HashiCorp Consul
Summary
CVE-2021-38698: HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Affects github.com/hashicorp/consul across 3 version ranges.
< 1.8.15
>= 1.9.0, < 1.9.9
>= 1.10.1, < 1.10.2
Fixed in 1.8.15, 1.9.9 or 1.10.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-38698 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is a popular open-source service mesh solution that provides service discovery, configuration, and segmentation capabilities. It is written in Go and is widely used for managing distributed systems. Consul allows services to register and discover each other, facilitating communication within the system.
Vulnerability Detail
The vulnerability (GO-2022-0559) in HashiCorp Consul and Consul Enterprise versions 1.10.1 and below allows services to register proxies for other services. This enables unauthorized access to service traffic, potentially leading to data breaches, unauthorized information disclosure, or other malicious activities. The vulnerability exists in the Txn.Apply endpoint, which should only allow services to register themselves, not act on behalf of other services.
How To Fix
Latest published version: v1.22.7 as of 22 Oct 2026
go get github.com/hashicorp/consul@v1.22.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.8.151.8.15go get github.com/hashicorp/consul@v1.8.15 -
>= 1.9.0, < 1.9.91.9.9go get github.com/hashicorp/consul@v1.9.9 -
>= 1.10.1, < 1.10.21.10.2go get github.com/hashicorp/consul@v1.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions mentioned above.
Conclusion
The vulnerability in HashiCorp Consul and Consul Enterprise versions 1.10.1 and below allows unauthorized services to register proxies for other services, potentially leading to unauthorized access to service traffic. It is crucial to upgrade to the fixed versions (1.8.15, 1.9.9, or 1.10.2) to mitigate this vulnerability.
See every vulnerability recorded for github.com/hashicorp/consul →
FAQ
The vulnerability allows unauthorized services to register proxies for other services, potentially leading to unauthorized access to service traffic and possible data breaches.
The vulnerability affects Consul and Consul Enterprise versions 1.10.1 and below.
There are no known public exploits for this vulnerability at the time of this report.
Yes, the vulnerability has been fixed in versions 1.8.15, 1.9.9, and 1.10.2 of HashiCorp Consul. It is recommended to upgrade to one of these versions.
No, upgrading to the fixed versions is the only known solution to mitigate this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/consul.
