HCSEC-2022-28

**Bulletin ID:** HCSEC-2022-28 **Affected Products / Versions:** Consul and Consul Enterprise 1.13.0 up to 1.13.3; fixed in 1.14.0. **Publication Date:** November 15, 2022 **Summary** A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that the `/v1/internal/ui/nodes` and `/v1/internal/ui/services` HTTP endpoints do not properly filter information by ACL policies. This vulnerability, CVE-2022-3920, was fixed in Consul 1.14.0. **Background** Consul [cluster peering](https://developer.hashicorp.com/consul/docs/v1.13.x/connect/cluster-peering) is a beta feature to support peering connections between two or more independent clusters so that services deployed to different partitions or datacenters can communicate. **Details** During internal testing, we observed that node and service information imported through cluster peering was being leaked. To exploit this vulnerability, an attacker does not require access to an ACL token. The peering feature was introduced in Consul 1.13.0 as a beta feature. For more information on cluster peering, see the [documentation](https://developer.hashicorp.com/consul/docs/connect/cluster-peering). **Remediation** Customers, particularly those using the new cluster peering feature, should evaluate the risk associated with this issue and consider upgrading to Consul 1.14.0, or newer. **Acknowledgement** This issue was identified by the Consul engineering team. *We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security).*