{"action":"Upgrade github.com/hashicorp/consul to 1.11.9 or later.","affected":[{"fixed":"1.11.9","introduced":"0"},{"fixed":"1.12.5","introduced":"1.12.0"},{"fixed":"1.13.2","introduced":"1.13.0"}],"component":"github.com/hashicorp/consul","cve_ids":["CVE-2022-40716"],"ecosystem":"Go","epss":0.0109,"exploited":false,"fixed_versions":["1.11.9","1.12.5","1.13.2"],"ghsa_id":"GHSA-m69r-9g56-7mv8","id":"tcs_01M5KFFC11M2SR4RB32HVVEVF2","modified_at":"2026-09-10T03:49:45.765196342Z","published_at":"2022-09-25T00:00:27Z","references":["https://osv.dev/vulnerability/GHSA-m69r-9g56-7mv8","https://nvd.nist.gov/vuln/detail/CVE-2022-40716","https://github.com/hashicorp/consul/pull/14579","https://github.com/hashicorp/consul/commit/8f6fb4f6fe9488b8ec37da71ac503081d7d3760b","https://discuss.hashicorp.com","https://discuss.hashicorp.com/t/hcsec-2022-20-consul-service-mesh-intention-bypass-with-malicious-certificate-signing-request/44628","https://github.com/hashicorp/consul","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-m69r-9g56-7mv8","url":"https://osv.dev/vulnerability/GHSA-m69r-9g56-7mv8"}],"summary":"HashiCorp Consul vulnerable to authorization bypass"}