Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-467g-8bds-t3ef
Vulnerability ID VCID-467g-8bds-t3ef
Aliases CVE-2019-12291
GHSA-h65h-v7fw-4p38
Summary HashiCorp Consul Incorrect Access Control vulnerability HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured. ### Specific Go Packages Affected github.com/hashicorp/consul/acl
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-284 Improper Access Control
System Score Found at
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2019-12291
cvssv3.1 7.5 https://github.com/hashicorp/consul
generic_textual HIGH https://github.com/hashicorp/consul
cvssv3.1 7.5 https://github.com/hashicorp/consul/commit/36ebca1fd0129278487c6570449bc8cc03987890
generic_textual HIGH https://github.com/hashicorp/consul/commit/36ebca1fd0129278487c6570449bc8cc03987890
cvssv3.1 7.5 https://github.com/hashicorp/consul/issues/5888
generic_textual HIGH https://github.com/hashicorp/consul/issues/5888
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2019-12291
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2019-12291
cvssv3.1 7.5 https://www.hashicorp.com/blog/category/consul
generic_textual HIGH https://www.hashicorp.com/blog/category/consul
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2019-12291
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12291
https://github.com/hashicorp/consul
https://github.com/hashicorp/consul/commit/36ebca1fd0129278487c6570449bc8cc03987890
https://github.com/hashicorp/consul/issues/5888
https://nvd.nist.gov/vuln/detail/CVE-2019-12291
https://www.hashicorp.com/blog/category/consul
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/hashicorp/consul
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/hashicorp/consul/commit/36ebca1fd0129278487c6570449bc8cc03987890
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/hashicorp/consul/issues/5888
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-12291
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://www.hashicorp.com/blog/category/consul
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.61822
EPSS Score 0.0042
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:59:15.883729+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-h65h-v7fw-4p38/GHSA-h65h-v7fw-4p38.json 38.0.0