cve.bz

CVE-2021-37219

8.8 highEPSS 1.1%

High (8.8) in hashicorp consul. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/consul 1.10.2, 1.8.15, 1.9.9.

HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE
CWE-295
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-ccw8-7688-vqx4Gogithub.com/hashicorp/consul>=1.10.1 <1.10.21.10.2
GHSA-ccw8-7688-vqx4Gogithub.com/hashicorp/consul>=1.9.0 <1.9.91.9.9
GHSA-ccw8-7688-vqx4Gogithub.com/hashicorp/consul<1.8.151.8.15
GO-2022-0593Gogithub.com/hashicorp/consul<1.8.15
>=1.9.0 <1.9.9
>=1.10.1 <1.10.2		1.8.15, 1.9.9, 1.10.2

References

Check your stackJSON