---
id: CVE-2022-3920
aliases:
  - GHSA-gw2g-hhc9-wgjh
  - BIT-consul-2022-3920
  - GO-2022-1121
title: Missing Authorization in HashiCorp Consul
summary: Missing Authorization in HashiCorp Consul
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: hashicorp
product: github.com/hashicorp/consul
ecosystem: go
affected:
  - 'github.com/hashicorp/consul >= 1.13.0, < 1.14.0'
patched:
  - github.com/hashicorp/consul 1.14.0
published: '2022-11-16'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-gw2g-hhc9-wgjh'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-3920'
  - url: >-
      https://github.com/hashicorp/consul/commit/706866fa0016b0aa302679f9c648859050d19b2e
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946
tags:
  - osv
  - go
epss: 0.00704
epssPercentile: 0.51913
ingestedAt: '2026-08-07T19:14:17.081Z'
---

## Overview

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

## Affected packages

- `github.com/hashicorp/consul >= 1.13.0, < 1.14.0`

## Remediation

Upgrade to a patched release:

- `github.com/hashicorp/consul 1.14.0`