Vulnerability Database

296,733

Total vulnerabilities in the database

CVE-2023-3518

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

Published: Aug 9, 2023
Updated: Aug 17, 2023
CVE: CVE-2023-3518
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
hashicorp / consul	1.16.0-rc1	1.16.0-rc1.x
hashicorp / consul	1.16.0	1.16.0.x

https://discuss.hashicorp.com/t/hcsec-2023-25-consul-jwt-auth-in-l7-intentions-allow-for-mismatched-service-identity-and-jwt-providers/57004

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo