HashiCorp Boundary and Boundary Enterprise contain a server-side request forgery in the Vault credential store integration. An authenticated user who can manage credential stores and credential libraries within a project can make the Boundary controller send requests to a destination of their choice and receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service.
HashiCorp · Boundary
HashiCorp Nomad and Nomad Enterprise follow symbolic links during same-client allocation data migration. A workload that can submit or update jobs can plant a symlink in a task-local directory, which Nomad preserves and later follows when setting directory permissions and ownership. On clients running as root, this can change permissions and ownership of host directories outside the allocation, enabling unauthorized access to host data, modification of host files and possibly privilege escalation (CVSS 8.8).
HashiCorp · Nomad
Consul-k8s versions 0.42.0 and later allow a cross-namespace authorization bypass in component ACL binding rules. An attacker who can create a ServiceAccount and obtain its token in another Kubernetes namespace, and who can reach the Consul API, may authenticate as a Consul component and gain its elevated privileges. The issue only affects deployments with global.acls.manageSystemACLs=true.
HashiCorp · Consul-k8s
HashiCorp Consul and Consul Enterprise contain an authorization bypass in service mesh proxy registration. A user who holds service write permission, but not the mesh write permission normally required, can apply Envoy escape-hatch configuration to a sidecar proxy. Successful exploitation may allow code execution within the proxy, access to or modification of its traffic, or bypass of intention enforcement; the issue only affects deployments with ACLs enabled where principals hold service write without mesh write.
HashiCorp · Consul
