This vulnerability is located in HashiCorp Consul’s service mesh proxy registration code. A user who has service write rights, but not the required mesh write permission, can inject an Envoy escape-hatch configuration, effectively bypassing the intended authorization controls. The result is the ability to modify Envoy settings for a service without proper authority, which could allow an attacker to alter traffic flow or facilitate lateral movement within a cluster. The weakness is a permission validation error (CWE‑178).

HashiCorp Consul Community Edition versions prior to 2.1.0 and HashiCorp Consul Enterprise versions prior to 2.1.0 and 1.21.19 are affected. Users of older releases that have not applied the points‑in‑fix for Consul’s service mesh registration must review their version roll‑up status.

The CVSS severity score of 8.8 classifies this as a high‑impact flaw that requires careful mitigation. EPSS data is not publicly available, but the absence of a KEV listing does not diminish the risk to environments that grant service write permissions. The attacker must be able to write to the service configuration, a privilege often granted to internal services or automated processes; thus the most likely attack vector is an internal compromise or mis‑configuration that bestows write access to a legitimate user or process.