-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/consul | go | >= 1.8.1, < 1.11.9 | 1.11.9 |
| github.com/hashicorp/consul | go | >= 1.12.0, < 1.12.5 | 1.12.5 |
| github.com/hashicorp/consul | go | >= 1.13.0, < 1.13.2 | 1.13.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing input validation in the JWT authorization process for auto-config requests. The commit diff shows added regex validation for node/segment/partition fields in jwtAuthorizer.Authorize(), indicating these parameters were previously unvalidated. The CWE-862 (Missing Authorization) aligns with insufficient validation before using these parameters in security-critical JWT claim assertions. The vulnerable function handles the authorization logic and would have processed untrusted input without sanitization prior to the patch.