Token Scope Enforcement Flaw in HashiCorp Consul and Consul Enterprise
CVE-2020-13170

7.5HIGH

Key Information:

Vendor: Hashicorp
Status: Consul
Vendor: CVE Published:; 11 June 2020

What is CVE-2020-13170?

A flaw in HashiCorp Consul and Consul Enterprise allows local tokens issued by a primary data center to bypass scope enforcement when replication to a secondary data center is disabled. This issue impacts versions 1.4.0 through 1.6.5, making it crucial for users to update to version 1.6.6 or higher to mitigate potential risks associated with unauthorized token access. Detailed changelogs from GitHub provide insights into the resolution of this vulnerability.