# HCSEC-2021-29 - Consul Enterprise Namespace Default ACLs Allow Privilege Escalation

**URL:** <https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871>\
**Category:** Security\
**Tags:** security-consul\
**Created:** [November 13, 2021, 1:11am UTC](https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871 "2021-11-13T01:11:52Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jfinnigan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jfinnigan/32/3834_2.png) [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Post date:** [November 13, 2021, 1:11am UTC](https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871/1 "2021-11-13T01:11:52Z")

</div>

**Bulletin ID:** HCSEC-2021-29  
**Affected Products / Versions:** Consul Enterprise 1.7.0 and newer; fixed in 1.8.17, 1.9.11, and 1.10.4.  
**Publication Date:** November 12, 2021

**Summary**  
A vulnerability was identified in Consul Enterprise such that an ACL token with the default `operator:write` permissions in one namespace may be used to escalate privileges into any other permissions across all namespaces. This vulnerability, CVE-2021-41805, was fixed in Consul Enterprise 1.8.17, 1.9.11, and 1.10.4.

**Background**  
Consul Enterprise uses [namespaces](https://www.consul.io/docs/enterprise/namespaces) and the [ACL system](https://www.consul.io/docs/security/acl) for restricting access to resources such as services and nodes. The [operator ACL rule](https://www.consul.io/docs/security/acl/acl-rules#operator-rules) (such as `operator:read`) is used for cluster-level operations found in the [operator API](https://www.consul.io/api/operator), with the one exception being the [keyring API](https://www.consul.io/api-docs/operator/keyring).

**Details**  
During internal testing, it was observed that an ACL token configured with default `operator:write` permissions may be used to escalate privileges into any other permissions across all namespaces.

Consul Enterprise’s authorization logic has been modified to prohibit this.

**Remediation**  
Customers should evaluate the risk associated with this issue and consider upgrading to Consul Enterprise 1.10.4, 1.9.11, 1.8.17, or newer. Please refer to [Upgrading Consul](https://www.consul.io/docs/upgrading) for general guidance and version-specific upgrade notes.

**Acknowledgement**  
This issue was identified by the Consul engineering team.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [Security at HashiCorp](https://hashicorp.com/security)._