HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/hashicorp/consul(Go) | 1.2.0 | 1.6.10 | N/A |
| github.com/hashicorp/consul(Go) | 1.7.0 | 1.7.10 | N/A |
| github.com/hashicorp/consul(Go) | 1.8.0 | 1.8.6 | N/A |
CVSS Metrics
