CVE catalog
CVE-2021-41803
UBUNTU-CVE-2021-41803
- Severity
- High · CVSS 7.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 1.07% · Oct 25, 2026
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | consul | 11 | 1.10.12+dfsg1-1 | vulnerable |
| Debian | consul | 11 | 1.8.7+dfsg1-2 | vulnerable |
| Debian | consul | 11 | 1.8.7+dfsg1-3 | vulnerable |
| Debian | consul | 11 | 1.8.7+dfsg1-4 | vulnerable |
| Debian | consul | 11 | 1.8.7+dfsg1-5 | vulnerable |
| Debian | consul | 11 | 1.8.7+dfsg1-6 | vulnerable |
| Debian | consul | 11 | 1.9.17+dfsg2-1 | vulnerable |
| Ubuntu | consul | 18.04 | 0.6.4~dfsg-3 | vulnerable |
| Ubuntu | consul | 20.04 | 1.0.7~dfsg1-5ubuntu1 | vulnerable |
| Ubuntu | consul | 20.04 | 1.4.4~dfsg1-2ubuntu2 | vulnerable |
| Ubuntu | consul | 20.04 | 1.5.2+dfsg1-6 | vulnerable |
| Ubuntu | consul | 20.04 | 1.5.2+dfsg1-10 | vulnerable |
| Ubuntu | consul | 20.04 | 1.5.2+dfsg1-12 | vulnerable |
| Ubuntu | consul | 20.04 | 1.5.2+dfsg2-14 | vulnerable |
| Ubuntu | consul | 22.04 | 1.7.4+dfsg1-1 | vulnerable |
| Ubuntu | consul | 22.04 | 1.8.7+dfsg1-3 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: