CVE-2021-37219: HashiCorp Consul Privilege Escalation Vulnerability
Summary
CVE-2021-37219: HashiCorp Consul Privilege Escalation Vulnerability in github.com/hashicorp/consul. Affects github.com/hashicorp/consul across 3 version ranges.
< 1.8.15
>= 1.9.0, < 1.9.9
>= 1.10.1, < 1.10.2
Fixed in 1.8.15, 1.9.9 or 1.10.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-37219 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is an open-source service mesh solution that provides a distributed, highly available, and scalable platform for service discovery, configuration, and segmentation across microservices. It is written in Go and is widely used in cloud-native environments. However, a privilege escalation vulnerability has been discovered in the Consul package.
Vulnerability Detail
The vulnerability (CVE-2021-37219) allows an attacker to escalate privileges in HashiCorp Consul. This could lead to unauthorized access to sensitive information, unauthorized modifications, or even complete control over the affected system. The vulnerability originates from a flaw in the Consul package, specifically in the way it handles certain operations. Attackers can exploit this flaw to bypass security measures and gain elevated privileges.
How To Fix
Latest published version: v1.22.7 as of 22 Oct 2026
go get github.com/hashicorp/consul@v1.22.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.8.151.8.15go get github.com/hashicorp/consul@v1.8.15 -
>= 1.9.0, < 1.9.91.9.9go get github.com/hashicorp/consul@v1.9.9 -
>= 1.10.1, < 1.10.21.10.2go get github.com/hashicorp/consul@v1.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is essential to update the Consul package to the fixed versions mentioned above.
Conclusion
The privilege escalation vulnerability in HashiCorp Consul (CVE-2021-37219) poses a significant risk to systems utilizing this package. It is crucial to update to the fixed versions to mitigate the vulnerability and ensure the security of the system.
See every vulnerability recorded for github.com/hashicorp/consul →
FAQ
HashiCorp Consul is an open-source service mesh solution that provides service discovery, configuration, and segmentation across microservices in cloud-native environments.
The vulnerability allows attackers to escalate privileges in HashiCorp Consul, potentially leading to unauthorized access, modifications, or control over the affected system.
To fix this vulnerability, update the Consul package to version 1.8.15, 1.9.9, or 1.10.2, depending on the currently installed version.
No, there are no known workarounds for this vulnerability. Updating the Consul package is the recommended solution.
You can find more information about this vulnerability in the HashiCorp Consul documentation or the provided vulnerability database URL.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/consul.
