CVE-2021-36213

HashiCorp Consul L7 deny intention results in an allow action

7.5 HighFix available

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

1.69%Up 1.1 points since Jul 18, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2021-36213
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-36213
Updated: 2026-11-02

EUVDEUVD-2021-1451 No score

Record: EUVD-2021-1451
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8h2g-r292-j8xh 7.5

HashiCorp Consul L7 deny intention results in an allow action

In HashiCorp Consul before 1.10.1 (and Consul Enterprise), xds can generate a situation where a single L7 deny intention (with a default deny policy) results in an allow action.

Record: GHSA-8h2g-r292-j8xh
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSV 7.5

Record: CVE-2021-36213
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-8h2g-r292-j8xh 7.5

HashiCorp Consul L7 deny intention results in an allow action

In HashiCorp Consul before 1.10.1 (and Consul Enterprise), xds can generate a situation where a single L7 deny intention (with a default deny policy) results in an allow action.

Record: GHSA-8h2g-r292-j8xh
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-36213 7.5

Record: UBUNTU-CVE-2021-36213
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVBIT-consul-2021-36213 No score

Record: BIT-consul-2021-36213
Updated: 2026-11-02

OSVGO-2022-0895 No score

HashiCorp Consul L7 deny intention results in an allow action in github.com/hashicorp/consul

HashiCorp Consul L7 deny intention results in an allow action in github.com/hashicorp/consul

Record: GO-2022-0895
Updated: 2026-11-02

Affected products

hashicorp consul

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/hashicorp/consul` Go	before 1.10.1	1.10.1
`consul` Bitnami	1.9.0 up to 1.9.8, 1.10.0 up to 1.10.1	1.9.81.10.1
`consul` Ubuntu:18.04:LTS	All versions, plus listed versions 0.6.4~dfsg-3	None known
`consul` Ubuntu:20.04:LTS	All versions, plus listed versions 1.0.7~dfsg1-5ubuntu11.4.4~dfsg1-2ubuntu21.5.2+dfsg1-61.5.2+dfsg1-101.5.2+dfsg1-121.5.2+dfsg2-14	None known
`consul` Ubuntu:22.04:LTS	All versions, plus listed versions 1.7.4+dfsg1-11.8.7+dfsg1-3	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-36213 is a high vulnerability (CVSS 7.5) in Hashicorp Consul, published July 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in github.com/hashicorp/consul 1.10.1.