CVE-2020-7955

5.3 mediumEPSS 1.4%

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2020-01-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hashicorp:consul

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-r9w6-rhh9-7v53	Go	github.com/hashicorp/consul	>=1.4.1 <1.6.3	1.6.3
GO-2022-0874	Go	github.com/hashicorp/consul	>=1.4.1 <1.6.3	1.6.3

References

https://github.com/hashicorp/consul/issues/7160
https://www.hashicorp.com/blog/category/consul/
https://github.com/hashicorp/consul/issues/7160
https://www.hashicorp.com/blog/category/consul/

Check your stack JSON