CVE-2024-10086: Hashicorp Consul

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

Affected products

• Hashicorp Consul: from 1.4.1, before 1.15.15 (fixed in 1.15.15); from 1.4.1, before 1.20.0 (fixed in 1.20.0); from 1.18.0, before 1.18.5 (fixed in 1.18.5); from 1.19.0, before 1.19.3 (fixed in 1.19.3)

Published 2024-10-30. Last modified 2026-06-17.