CVE-2020-7955: Incorrect Authorization in HashiCorp Consul
Summary
CVE-2020-7955: Incorrect Authorization in HashiCorp Consul in github.com/hashicorp/consul. Affects github.com/hashicorp/consul versions >= 1.4.1, < 1.6.3. Fixed in 1.6.3. How to fix ↓
Also tracked for
The same CVE-2020-7955 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is an open-source service mesh solution that provides a distributed, highly available, and scalable platform for service discovery, configuration, and segmentation across microservices. It is written in Go and is widely used in various applications and environments. However, a vulnerability has been discovered in Consul that allows for incorrect authorization, potentially leading to unauthorized access and privilege escalation.
Vulnerability Detail
The vulnerability in HashiCorp Consul arises from a flaw in the authorization mechanism. Due to this issue, an attacker may be able to bypass the intended access controls and gain unauthorized access to sensitive resources or perform actions with elevated privileges. This can result in various security risks, including data breaches, unauthorized modifications, and disruption of services.
How To Fix
Latest published version: v1.22.7 as of 22 Oct 2026
go get github.com/hashicorp/consul@v1.22.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.3
This is the first release that contains the fix.
go get github.com/hashicorp/consul@v1.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional access controls or restrictions at the network or infrastructure level to mitigate the risk of unauthorized access. However, this should be considered a temporary solution, and upgrading to the patched version is strongly advised.
Conclusion
The incorrect authorization vulnerability in HashiCorp Consul poses a significant risk to the security and integrity of affected systems. It is crucial for users to promptly upgrade to a patched version and apply necessary security updates to mitigate the risk of unauthorized access and privilege escalation.
See every vulnerability recorded for github.com/hashicorp/consul →
FAQ
The vulnerability allows for incorrect authorization, potentially leading to unauthorized access and privilege escalation. This can result in data breaches, unauthorized modifications, and disruption of services.
Versions 1.4.1 through 1.6.2 of HashiCorp Consul are affected by this vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to mitigate the risk.
Yes, a patch for this vulnerability is available in version 1.6.3 of HashiCorp Consul. It is recommended to upgrade to this version or a later one to address the issue.
While additional access controls or restrictions can be implemented as a temporary workaround, upgrading to the patched version is the recommended solution to fully mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/consul.
