HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control.

published 2021-12-12 4 y ago modified 2026-09-08 2 mo ago also BIT-consul-2021-41805 , EUVD-2021-28810

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 34.8%; EPSS 34.8% chance of exploitation in 30 days, percentile 98%
public exploits: 0; none known

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.

Patch / fix

fixed in 2

bitnami consul 1.8.17, 1.9.11, 1.10.4
hashicorp consul 1.8.17, 1.9.11, 1.10.4

Exploit prediction

34.79% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
OSV	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	consul	>=1.7.0, <1.8.17 >=1.9.0, <1.9.11 >=1.10.0, <1.10.4	1.8.17 1.9.11 1.10.4

Classification

Weakness

CWE-863 Incorrect Authorization

References

hashicorp.com /blog/category/consul
product, vendor-advisory, advisory
discuss.hashicorp.com /t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871
vendor-advisory, advisory
security.netapp.com /advisory/ntap-20211229-0007/
third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2021-41805
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary