-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/consul | go | >= 1.13.0, < 1.14.0 | 1.14.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing ACL checks on imported cluster data in two key areas: 1) The filterNodeDump() function in aclfilter/filter.go initially only processed the main Dump field, leaving ImportedDump unfiltered. 2) The NodeInfo authorization context in structs_oss.go didn't include peer information before the patch, preventing proper cross-cluster ACL validation. The commit 706866f addresses both by adding ImportedDump filtering and propagating peer context, confirming these were the vulnerable points.