CVE-2021-36213
mediumpriority · track · 31EPSS 0.017 · 77 %ileEUUSEPSS · scored 2026-10-27
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- GHSA-8h2g-r292-j8xhHashiCorp Consul L7 deny intention results in an allow action2021-07-19ghsa · osvUS
In HashiCorp Consul before 1.10.1 (and Consul Enterprise), xds can generate a situation where a single L7 deny intention (with a default deny policy) results in an allow action.
- BIT-consul-2021-362132024-03-06vendor · osvUS
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.
- GO-2022-0895HashiCorp Consul L7 deny intention results in an allow action in github.com/hashicorp/consul2024-08-21vendor · osvUS
HashiCorp Consul L7 deny intention results in an allow action in github.com/hashicorp/consul
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202107-1240cnnvd
- EUVD-2021-1451enisa_euvd
- GHSA-8h2g-r292-j8xhenisa_euvd
- BIT-consul-2021-36213osv
- GHSA-8h2g-r292-j8xhosv
- GO-2022-0895osv
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855cnnvd
- https://github.com/hashicorp/consul/releases/tag/v1.10.1cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-36213cnnvd
- https://packetstormsecurity.com/files/168026/Gentoo-Linux-Security-Advisory-202208-09.htmlcnnvd
- https://security.gentoo.org/glsa/202208-09cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021071907cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021072709cnnvd
- https://www.hashicorp.com/blog/category/consulcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan