High severity7.4NVD Advisory· Published Aug 9, 2023· Updated Jun 17, 2026

CVE-2023-3518

Description

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/hashicorp/consulGo	>= 1.16.0, < 1.16.1	1.16.1

Affected products

Hashicorp/Consul4 versions
cpe:2.3:a:hashicorp:consul:1.16.0:*:*:*:enterprise:*:*:*+ 3 more
- cpe:2.3:a:hashicorp:consul:1.16.0:*:*:*:enterprise:*:*:*
- cpe:2.3:a:hashicorp:consul:1.16.0:-:*:*:-:*:*:*
- cpe:2.3:a:hashicorp:consul:1.16.0:rc1:*:*:-:*:*:*
- (no CPE)range: 1.16.0
osv-coords8 versions
pkg:apk/chainguard/consul-1.16 pkg:apk/chainguard/consul-1.16-oci-entrypoint pkg:apk/chainguard/consul-1.16-oci-entrypoint-compat pkg:apk/wolfi/consul-1.16 pkg:apk/wolfi/consul-1.16-oci-entrypoint pkg:apk/wolfi/consul-1.16-oci-entrypoint-compat pkg:bitnami/consul pkg:golang/github.com/hashicorp/consul
< 1.16.1-r0+ 7 more
- (no CPE)range: < 1.16.1-r0
- (no CPE)range: < 1.16.1-r0
- (no CPE)range: < 1.16.1-r0
- (no CPE)range: < 1.16.1-r0
- (no CPE)range: < 1.16.1-r0
- (no CPE)range: < 1.16.1-r0
- (no CPE)range: >= 1.16.0, < 1.16.1
- (no CPE)range: >= 1.16.0, < 1.16.1
Hashicorp/Consul Enterprisecpe-rescue
Range: 1.16.0

Patches

Vulnerability mechanics

References

discuss.hashicorp.com/t/hcsec-2023-25-consul-jwt-auth-in-l7-intentions-allow-for-mismatched-service-identity-and-jwt-providers/57004nvdVendor AdvisoryWEB
github.com/advisories/GHSA-9rhf-q362-77mxghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-3518ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.481
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000