products / consul

HashiCorp Consul

HashiCorp Consul provides service discovery, health checking, and Connect service mesh for multi-cloud and Kubernetes environments. Platform stacks often pair it with HashiCorp Vault. NVD tracks it as hashicorp:consul with semver-style version ranges across concurrent minor trains.

api usage

Querying Consul

product slugconsul

version format1.22.0, 1.16.0, 1.14.0

bash

curl "https://api.attestd.io/v1/check?product=consul&version=1.16.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Consul 1.16.0 is affected by CVE-2023-3518 (denial of service via malicious HTTP/2 stream handling). The response shows risk_state: "high".

json

{
  "product": "consul",
  "version": "1.16.0",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "2.0.3",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2023-3518",
    "CVE-2024-10005",
    "CVE-2024-10006",
    "CVE-2024-10086",
    "CVE-2025-11374",
    "CVE-2025-11375",
    "CVE-2026-15972",
    "CVE-2026-19015",
    "CVE-2026-19113"
  ],
  "cves": null,
  "max_epss": 0.00715,
  "last_updated": "2026-08-16T11:18:08.825063Z",
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null,
    "source_published_at": null,
    "observed_at": null,
    "ingested_at": null,
    "first_served_at": null,
    "provenance": null
  },
  "supply_chain_monitored": true,
  "typosquat": null
}

safe version

Consul 1.22.0 sits past the ACL, Raft RPC, and health-check SSRF fixes on the 1.8 through 1.11 trains and is a current stable line for new deployments.

bash

curl "https://api.attestd.io/v1/check?product=consul&version=1.22.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Consul CVE history emphasizes ACL token scope mistakes, Raft RPC trust boundaries between clients and servers, and SSRF from HTTP health checks. NVD has not published a CRITICAL base score or CISA KEV entry for the rows below. Exposed WAN or public RPC still carries high blast radius when ACL and TLS settings are weak.

CVE	Description	Affects	CVSS
`CVE-2021-41805`	ACL token with default operator:write reaches write paths that should be denied (Enterprise).	≥1.7.0 <1.8.17 / ≥1.9 <1.9.11 / ≥1.10 <1.10.4	8.8
`CVE-2021-37219`	Raft RPC allows non-server agents with valid CA-signed certs into server-only functions.	<1.8.15 / ≥1.9 <1.9.9 / ≥1.10 <1.10.2	8.8
`CVE-2019-8336`	Client bypasses access restrictions and obtains another client's privileges.	≥1.4.0 <1.4.3	8.1
`CVE-2022-29153`	HTTP health-check redirects enable SSRF from the Consul client agent.	<1.9.17 / ≥1.10 <1.10.10 / ≥1.11 <1.11.5	7.5

data sources

HashiCorp Consul CPE namespace

NVD records Consul under the HashiCorp vendor string. Attestd maps the consul slug to that CPE and matches concurrent minor-train ranges, including Enterprise-only ACL issues when NVD lists them on the same product identifier.

cpe:2.3:a:hashicorp:consulConsul agents and servers

Query the Consul binary or container tag your agents run. Vault uses a separate product slug even when both sit in the same platform stack.

All products HashiCorp Vault Istio Quickstart