Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9wyg-uv2p-d3ez
Vulnerability ID VCID-9wyg-uv2p-d3ez
Aliases CVE-2021-37219
GHSA-ccw8-7688-vqx4
Summary HashiCorp Consul Privilege Escalation Vulnerability HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-295 Improper Certificate Validation
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-37219.json
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
epss 0.00428 https://api.first.org/data/v1/epss?cve=CVE-2021-37219
cvssv3.1 8.8 https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024
generic_textual HIGH https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024
cvssv3.1 8.8 https://github.com/hashicorp/consul
generic_textual HIGH https://github.com/hashicorp/consul
cvssv3.1 8.8 https://github.com/hashicorp/consul/commit/3357e57dac9aadabd476f7a14973e47f003c4cf0
generic_textual HIGH https://github.com/hashicorp/consul/commit/3357e57dac9aadabd476f7a14973e47f003c4cf0
cvssv3.1 8.8 https://github.com/hashicorp/consul/commit/473edd1764b6739e2e4610ea5dede4c2bc6009d1
generic_textual HIGH https://github.com/hashicorp/consul/commit/473edd1764b6739e2e4610ea5dede4c2bc6009d1
cvssv3.1 8.8 https://github.com/hashicorp/consul/commit/ccf8eb1947357434eb6e66303ddab79f4c9d4103
generic_textual HIGH https://github.com/hashicorp/consul/commit/ccf8eb1947357434eb6e66303ddab79f4c9d4103
cvssv3.1 8.8 https://github.com/hashicorp/consul/pull/10925
generic_textual HIGH https://github.com/hashicorp/consul/pull/10925
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2021-37219
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-37219
archlinux High https://security.archlinux.org/AVG-2360
cvssv3.1 8.8 https://security.gentoo.org/glsa/202207-01
generic_textual HIGH https://security.gentoo.org/glsa/202207-01
cvssv3.1 8.8 https://www.hashicorp.com/blog/category/consul
generic_textual HIGH https://www.hashicorp.com/blog/category/consul
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-37219.json
https://api.first.org/data/v1/epss?cve=CVE-2021-37219
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37219
https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024
https://github.com/hashicorp/consul
https://github.com/hashicorp/consul/commit/3357e57dac9aadabd476f7a14973e47f003c4cf0
https://github.com/hashicorp/consul/commit/473edd1764b6739e2e4610ea5dede4c2bc6009d1
https://github.com/hashicorp/consul/commit/ccf8eb1947357434eb6e66303ddab79f4c9d4103
https://github.com/hashicorp/consul/pull/10925
https://nvd.nist.gov/vuln/detail/CVE-2021-37219
https://security.gentoo.org/glsa/202207-01
https://www.hashicorp.com/blog/category/consul
1015218 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1015218
2008169 https://bugzilla.redhat.com/show_bug.cgi?id=2008169
AVG-2360 https://security.archlinux.org/AVG-2360
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-37219.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/hashicorp/consul
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/hashicorp/consul/commit/3357e57dac9aadabd476f7a14973e47f003c4cf0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/hashicorp/consul/commit/473edd1764b6739e2e4610ea5dede4c2bc6009d1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/hashicorp/consul/commit/ccf8eb1947357434eb6e66303ddab79f4c9d4103
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/hashicorp/consul/pull/10925
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-37219
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/202207-01
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.hashicorp.com/blog/category/consul
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.62347
EPSS Score 0.00428
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:01:02.773384+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-ccw8-7688-vqx4/GHSA-ccw8-7688-vqx4.json 38.0.0