Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Consul can skip source address check with certain callbacks

published 17 days ago
Summary

The Consul software may fail to verify the source address when a callback other than a public‑key is used, potentially allowing unauthorized access. This issue builds on a prior fix for SSH configuration misuse. Update Consul to the latest version that includes the corrective patch.

What to do
  • Update cleanstart consul to version 1.21.5-r3.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart consul < 1.21.5-r3
Fix: upgrade to 1.21.5-r3
Original advisory text
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
Security vulnerability affects the consul package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Timeline
Published2 Oct 2026
Updated2 Oct 2026
First seen2 Oct 2026
Sources
CLEANSTART-2026-MP17411 · OSV
Track software like this
Free during beta