High severity8.8NVD Advisory· Published Dec 12, 2021· Updated Jun 17, 2026

CVE-2021-41805

Description

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Hashicorp/Consul2 versions
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*+ 1 more
- cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*range: >=1.7.0,<1.8.17
- (no CPE)range: <1.8.17, <1.9.11, <1.10.4
HashiCorp/Consul Enterprisedescription
Hashicorp/Consul Enterprisellm-fuzzy
Range: <1.8.17, <1.9.11, <1.10.4
osv-coords
pkg:bitnami/consul
Range: >= 1.7.0, < 1.8.17

Patches

Vulnerability mechanics

References

discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871nvdVendor Advisory
security.netapp.com/advisory/ntap-20211229-0007/nvdThird Party Advisory
www.hashicorp.com/blog/category/consulnvdProductVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.028
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000