Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
Consul in-memory keyring may ignore key usage confirmation
published 1 month ago
Summary
The Consul software’s in‑memory keyring can accept keys that are supposed to require user confirmation before they are used, but it does not actually enforce that check. This could let unauthorized actions run with those keys, reducing the intended security control. Update to the latest Consul release or apply the vendor’s patch to ensure the confirmation requirement is enforced.
What to do
- Update cleanstart consul to version 1.21.5-r3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | consul |
< 1.21.5-r3 Fix: upgrade to 1.21.5-r3
|
Original advisory text
in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it
Security vulnerability affects the consul package. The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published2 Oct 2026
Updated2 Oct 2026
First seen2 Oct 2026
Sources
CLEANSTART-2026-MD19554 · OSV
Track software like this
Free during beta