HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
{ "nvd_published_at": "2020-11-23T14:15:00Z", "cwe_ids": [ "CWE-732", "CWE-863" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-01-31T23:11:32Z" }