CVE-2022-29153: Hashicorp Consul SSRF Vulnerability
Summary
CVE-2022-29153: Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector. Affects github.com/hashicorp/consul across 3 version ranges.
< 1.9.17
>= 1.10.0, < 1.10.10
>= 1.11.0, < 1.11.5
Fixed in 1.9.17, 1.10.10 or 1.11.5, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-29153 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hashicorp Consul is an open-source service mesh solution that provides service discovery, configuration, and segmentation capabilities. It is written in Go and widely used for managing distributed systems. Consul includes HTTP health check endpoints that can be used to monitor the health of services. However, a vulnerability has been identified in Consul versions 0 to 1.9.16, 1.10.0 to 1.10.9, and 1.11.0 to 1.11.4, where HTTP health check endpoints returning an HTTP redirect can be abused as a vector for server-side request forgery (SSRF). An attacker can exploit this vulnerability to make arbitrary requests to internal resources, potentially leading to unauthorized access or information disclosure.
Vulnerability Detail
The vulnerability (CVE-2022-29153) in Hashicorp Consul allows an attacker to abuse HTTP health check endpoints returning an HTTP redirect as an SSRF vector. By manipulating the redirect URL, an attacker can make arbitrary requests to internal resources that are accessible to the Consul service. This can lead to unauthorized access, information disclosure, or further exploitation of internal systems. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: v1.22.7 as of 22 Oct 2026
go get github.com/hashicorp/consul@v1.22.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.9.171.9.17go get github.com/hashicorp/consul@v1.9.17 -
>= 1.10.0, < 1.10.101.10.10go get github.com/hashicorp/consul@v1.10.10 -
>= 1.11.0, < 1.11.51.11.5go get github.com/hashicorp/consul@v1.11.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the patched versions of Consul as soon as possible.
Conclusion
The SSRF vulnerability in Hashicorp Consul allows attackers to abuse HTTP health check endpoints for unauthorized access and information disclosure. It is crucial to upgrade to the latest patched versions of Consul (1.9.17, 1.10.10, or 1.11.5) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/consul →
FAQ
The vulnerability allows an attacker to abuse HTTP health check endpoints in Consul for SSRF attacks, potentially leading to unauthorized access, information disclosure, or further exploitation of internal systems.
Consul versions 0 to 1.9.16, 1.10.0 to 1.10.9, and 1.11.0 to 1.11.4 are affected by this vulnerability.
To mitigate this vulnerability, it is recommended to upgrade to Consul versions 1.9.17, 1.10.10, or 1.11.5, which contain the necessary fixes.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to apply the necessary patches to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/consul.
