---
id: CVE-2022-3920
aliases:
  - GHSA-gw2g-hhc9-wgjh
  - BIT-consul-2022-3920
  - GO-2022-1121
title: Missing Authorization in HashiCorp Consul
summary: Missing Authorization in HashiCorp Consul
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: hashicorp
product: github.com/hashicorp/consul
ecosystem: go
affected:
  - 'github.com/hashicorp/consul >= 1.13.0, < 1.14.0'
patched:
  - github.com/hashicorp/consul 1.14.0
published: '2022-11-16'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-gw2g-hhc9-wgjh'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-3920'
  - url: >-
      https://github.com/hashicorp/consul/commit/706866fa0016b0aa302679f9c648859050d19b2e
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946
tags:
  - osv
  - go
epss: 0.00718
epssPercentile: 0.53658
ingestedAt: '2026-08-07T19:14:17.081Z'
---

## Overview

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

## Affected packages

- `github.com/hashicorp/consul >= 1.13.0, < 1.14.0`

## Remediation

Upgrade to a patched release:

- `github.com/hashicorp/consul 1.14.0`