---
id: CVE-2021-41803
aliases:
  - GHSA-hr3v-8cp3-68rf
  - BIT-consul-2021-41803
  - GO-2024-2683
title: >-
  HashiCorp Consul does not properly validate node or segment names prior to
  usage in JWT claim assertions
summary: >-
  HashiCorp Consul does not properly validate node or segment names prior to
  usage in JWT claim assertions
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H'
vendor: hashicorp
product: github.com/hashicorp/consul
ecosystem: go
affected:
  - 'github.com/hashicorp/consul >= 1.8.1, < 1.11.9'
  - 'github.com/hashicorp/consul >= 1.12.0, < 1.12.5'
  - 'github.com/hashicorp/consul >= 1.13.0, < 1.13.2'
patched:
  - github.com/hashicorp/consul 1.11.9
  - github.com/hashicorp/consul 1.12.5
  - github.com/hashicorp/consul 1.13.2
published: '2022-09-25'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hr3v-8cp3-68rf'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-41803'
  - url: >-
      https://github.com/hashicorp/consul/pull/14577/commits/2c881259ce10e308ff03afc968c4165998fd7fee
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627
  - url: 'https://github.com/hashicorp/consul'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI
tags:
  - osv
  - go
epss: 0.01062
epssPercentile: 0.63092
ingestedAt: '2026-08-07T19:14:17.284Z'
---

## Overview

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.

## Affected packages

- `github.com/hashicorp/consul >= 1.8.1, < 1.11.9`
- `github.com/hashicorp/consul >= 1.12.0, < 1.12.5`
- `github.com/hashicorp/consul >= 1.13.0, < 1.13.2`

## Remediation

Upgrade to a patched release:

- `github.com/hashicorp/consul 1.11.9`
- `github.com/hashicorp/consul 1.12.5`
- `github.com/hashicorp/consul 1.13.2`