Medium severity6.5NVD Advisory· Published Nov 23, 2020· Updated Jun 17, 2026
CVE-2020-28053
CVE-2020-28053
Description
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/hashicorp/consulGo | >= 1.2.0, < 1.6.10 | 1.6.10 |
github.com/hashicorp/consulGo | >= 1.7.0, < 1.7.10 | 1.7.10 |
github.com/hashicorp/consulGo | >= 1.8.0, < 1.8.6 | 1.8.6 |
Affected products
5- HashiCorp/Consuldescription
- osv-coords2 versions
>= 1.2.0, < 1.6.10+ 1 more
- (no CPE)range: >= 1.2.0, < 1.6.10
- (no CPE)range: >= 1.2.0, < 1.6.10
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-6m72-467w-94rhghsaADVISORY
- github.com/hashicorp/consul/blob/master/CHANGELOG.mdnvdRelease NotesThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-28053ghsaADVISORY
- security.gentoo.org/glsa/202208-09nvdThird Party AdvisoryWEB
- www.hashicorp.com/blog/category/consulnvdProductVendor AdvisoryWEB
- github.com/hashicorp/consul/commit/ff5215d882ac51b49c2647aac46b42aa9c890ce3ghsaWEB
- github.com/hashicorp/consul/pull/9240ghsaWEB
News mentions
0No linked articles in our index yet.