CVE-2024-10006: Hashicorp Consul

Medium severity, CVSS 5.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.

Affected products

• Hashicorp Consul: from 1.4.1, before 1.20.1 (fixed in 1.20.1); from 1.9.0, before 1.15.15 (fixed in 1.15.15); from 1.18.0, before 1.18.5 (fixed in 1.18.5); from 1.19.0, before 1.19.3 (fixed in 1.19.3); version 1.20.0 only

Published 2024-10-30. Last modified 2026-06-17.