{"id":"CVE-2021-41803","aliases":["ALPINE-CVE-2021-41803","BIT-consul-2021-41803","DEBIAN-CVE-2021-41803","EUVD-2022-6841","GHSA-hr3v-8cp3-68rf","GO-2024-2683","UBUNTU-CVE-2021-41803"],"status":"published","title":"HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01069,"percentile":0.65112,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2022-09-23T00:00:00Z","modified":"2026-11-03T06:32:47Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/consul","fixed_in":["1.11.9","1.12.5","1.13.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"consul","fixed_in":["1.12.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"consul","fixed_in":["1.13.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"consul","fixed_in":["1.13.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"consul","fixed_in":["1.11.9","1.12.5","1.13.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.1"},{"fixed":"1.11.9"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.1"},{"fixed":"1.12.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.1"},{"fixed":"1.13.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.1"},{"fixed":"1.13.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.1"},{"fixed":"1.11.9"},{"introduced":"1.12.4"},{"fixed":"1.12.5"},{"introduced":"1.13.1"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.12+dfsg1-1","1.8.7+dfsg1-2","1.8.7+dfsg1-3","1.8.7+dfsg1-4","1.8.7+dfsg1-5","1.8.7+dfsg1-6","1.9.17+dfsg2-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.1"},{"fixed":"1.11.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.12.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.1"},{"fixed":"1.11.9"},{"introduced":"1.12.0"},{"fixed":"1.12.5"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.4~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.7~dfsg1-5ubuntu1","1.4.4~dfsg1-2ubuntu2","1.5.2+dfsg1-6","1.5.2+dfsg1-10","1.5.2+dfsg1-12","1.5.2+dfsg2-14"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.4+dfsg1-1","1.8.7+dfsg1-3"]}],"products":[{"vendor":"hashicorp","product":"consul"}],"references":[{"url":"https://www.hashicorp.com/blog/category/consul","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41803","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI","tags":["web"]},{"url":"https://github.com/hashicorp/consul/pull/14577/commits/2c881259ce10e308ff03afc968c4165998fd7fee","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-hr3v-8cp3-68rf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-41803","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-41803","tags":["advisory"]},{"url":"https://github.com/hashicorp/consul","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-41803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41803","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-41803","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"","status":"published","published":"2022-09-23T00:00:00Z","modified":"2025-05-27T15:22:09.4Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2022-6841","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"","status":"published","published":"2022-09-23T00:00:00Z","modified":"2025-05-27T15:22:09Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:38.348652Z"}],"ghsa":[{"id":"GHSA-hr3v-8cp3-68rf","title":"HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.","status":"published","published":"2022-09-25T00:00:15Z","modified":"2024-04-22T19:08:32Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:37:44.335614Z"}],"nvd":[{"id":"CVE-2021-41803","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"","status":"published","published":"2022-09-23T01:15:08.623Z","modified":"2026-06-17T04:08:56.557Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"ALPINE-CVE-2021-41803","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"","status":"published","published":"2022-09-23T01:15:08.623Z","modified":"2026-11-03T06:32:47.838548928Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2021-41803","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"","status":"published","published":"2022-09-23T01:15:08.623Z","modified":"2026-10-24T10:30:30.96246431Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-41803","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"","status":"published","published":"2022-09-23T01:15:08.623Z","modified":"2026-08-27T23:04:10.707207112Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"GHSA-hr3v-8cp3-68rf","title":"HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.","status":"published","published":"2022-09-25T00:00:15Z","modified":"2026-08-07T08:12:08.554184271Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"UBUNTU-CVE-2021-41803","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"","status":"published","published":"2022-09-23T01:15:00Z","modified":"2025-10-24T04:50:35Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"BIT-consul-2021-41803","description":"HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"","status":"published","published":"2024-03-06T10:52:42.202Z","modified":"2026-09-08T08:46:00.261020476Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"GO-2024-2683","title":"Improper handling of node names in JWT claims assertions in github.com/hashicorp/consul","description":"HashiCorp Consul does not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC.","status":"published","published":"2024-04-05T16:54:12Z","modified":"2026-08-07T08:12:27.004083333Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}