CVE-2020-7955: Hashicorp Consul

Medium severity, CVSS 5.3. EPSS: 1.4% chance of exploitation in the next 30 days.

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

Affected products

• Hashicorp Consul: from 1.4.1, before 1.6.2 (fixed in 1.6.2)

Published 2020-01-31. Last modified 2026-06-17.