{"id":"CVE-2022-3920","aliases":["GHSA-gw2g-hhc9-wgjh","BIT-consul-2022-3920","GO-2022-1121"],"title":"Missing Authorization in HashiCorp Consul","summary":"Missing Authorization in HashiCorp Consul","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"hashicorp","product":"github.com/hashicorp/consul","ecosystem":"go","affected":["github.com/hashicorp/consul >= 1.13.0, < 1.14.0"],"patched":["github.com/hashicorp/consul 1.14.0"],"published":"2022-11-16","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-gw2g-hhc9-wgjh","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3920"},{"url":"https://github.com/hashicorp/consul/commit/706866fa0016b0aa302679f9c648859050d19b2e"},{"url":"https://discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946"}],"tags":["osv","go"],"epss":0.00704,"epssPercentile":0.51484,"ingestedAt":"2026-08-07T19:14:17.081Z","slug":"CVE-2022-3920","body":"## Overview\n\nHashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.\n\n## Affected packages\n\n- `github.com/hashicorp/consul >= 1.13.0, < 1.14.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/hashicorp/consul 1.14.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}