CVE-2018-19653: Hashicorp Consul

Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days.

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.

Affected products

• Hashicorp Consul: from 0.5.1, up to and including 1.4.0

Published 2018-12-09. Last modified 2026-06-17.