Consul vulnerabilities

Consul Community Edition and Consul Enterprise versions 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This is fixed in Consul 2.0.3 and corresponding Enterprise versions.

Consul Community Edition and Consul Enterprise versions 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to exfiltration of sensitive secrets from the Consul server host.

Consul Community Edition and Consul Enterprise versions 1.19.1 through 2.0.2 did not enforce the `session:write` ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission.

Consul Community Edition and Consul Enterprise versions 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration.

A vulnerability in Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2 causes uncontrolled resource consumption in the Connect authorization endpoint. This allows an attacker to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

A vulnerability in Consul Community Edition and Consul Enterprise versions 1.18.0 through 2.0.2 allows an authenticated attacker to crash the Consul server during the Enterprise-to-Community downgrade path. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections.

A vulnerability in Consul Community Edition and Consul Enterprise versions 1.20.1 through 2.0.2 allows an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.