CVE-2021-41803: HashiCorp Consul Auth Bypass Vulnerability

CVE-2021-41803 Overview

CVE-2021-41803 is a missing authorization vulnerability [CWE-862] in HashiCorp Consul and Consul Enterprise. The flaw affects versions 1.8.1 through 1.11.8, 1.12.4, and 1.13.1. Consul fails to properly validate node or segment names before interpolating them into JSON Web Token (JWT) claim assertions during auto config Remote Procedure Calls (RPCs). An authenticated network attacker can leverage this gap to bypass intended JWT authorization checks. HashiCorp resolved the issue in releases 1.11.9, 1.12.5, and 1.13.2.

Critical Impact
Authenticated attackers can manipulate node or segment names to subvert JWT claim validation in the Consul auto config RPC, leading to authorization bypass and high availability impact on service mesh infrastructure.

Affected Products

HashiCorp Consul 1.8.1 through 1.11.8
HashiCorp Consul 1.12.0 through 1.12.4 (including Enterprise)
HashiCorp Consul 1.13.0 through 1.13.1 (including Enterprise)

Discovery Timeline

2022-09-23 - CVE-2021-41803 published to NVD
2025-05-27 - Last updated in NVD database

Technical Details for CVE-2021-41803

Vulnerability Analysis

The vulnerability resides in the Consul auto config RPC pathway. Consul uses JWT claim assertions to authorize agents requesting auto configuration. The server interpolates node and segment names supplied by the requesting client into these claim assertions without validating their contents.

The authorization check operates on the interpolated string. Because input is trusted before validation, an attacker controlling the node or segment name can craft values that alter the resulting claim assertion. The auto config RPC then accepts the manipulated assertion and authorizes the request beyond the operator's intent.

Exploitation requires network access to Consul RPC and low-privilege authentication. The result is a confidentiality impact on configuration data and a high availability impact on the cluster.

Root Cause

The root cause is missing authorization input validation [CWE-862]. Consul interpolates untrusted node and segment identifiers directly into JWT claim assertion templates. Without sanitization, attacker-controlled characters change the semantic meaning of the claim being evaluated, defeating the authorization decision.

Attack Vector

The attack vector is network-based. An attacker with valid low-privilege credentials submits an auto config RPC request with a specially crafted node or segment name. The Consul server interpolates the malicious value into the JWT claim assertion, evaluates the resulting expression, and grants access that the operator's ACL policy did not intend to permit. See the HashiCorp Security Advisory HCSEC-2022-19 for vendor technical details.

Detection Methods for CVE-2021-41803

Indicators of Compromise

Auto config RPC requests containing unusual characters, escape sequences, or claim-like substrings within node or segment name fields.
Successful auto config responses returned to agents whose node names do not match the configured ACL policy bindings.
Consul audit log entries showing JWT claim assertions that resolve unexpectedly for unprivileged identities.

Detection Strategies

Inspect Consul server logs for AutoConfig.InitialConfiguration RPC calls and correlate the supplied node name with the JWT subject claim.
Alert on any node or segment name containing JWT control characters such as quotes, braces, or colons.
Compare ACL token identity against the resolved node identity for every auto config response.

Monitoring Recommendations

Enable Consul audit logging on all server agents and forward events to a central analytics platform.
Monitor outbound auto config configuration payloads for unexpected ACL policy or service identity assignments.
Track the Consul server version inventory and alert when hosts run versions earlier than 1.11.9, 1.12.5, or 1.13.2.

How to Mitigate CVE-2021-41803

Immediate Actions Required

Upgrade Consul server and client agents to 1.11.9, 1.12.5, 1.13.2, or later, including matching Enterprise builds.
Audit existing ACL policies and node identities for unexpected privileges granted through auto config in the affected window.
Rotate any bootstrap and agent tokens that may have been issued through compromised auto config exchanges.

Patch Information

HashiCorp released fixes in Consul 1.11.9, 1.12.5, and 1.13.2. Fedora distributed corresponding package updates announced in FEDORA-2022-LYZOKMMVX4, FEDORA-2022-XNF4OLYZRQ, and FEDORA-2022-ZTE4ITXXPI. Review the HashiCorp Consul Blog for release notes.

Workarounds

Disable the auto config feature by setting auto_config.enabled = false on Consul servers until upgrades complete.
Restrict Consul RPC port 8300 access to trusted management networks using firewall rules or network policies.
Enforce strict ACL default-deny policies so node identities cannot self-elevate through auto config responses.

bash

# Configuration example: disable auto config on Consul servers
auto_config {
  enabled = false
}

# Restrict RPC access at the host firewall
iptables -A INPUT -p tcp --dport 8300 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8300 -j DROP