Vulnerability Reporthashicorp/consul:2.1.0

hashicorp/consul:latesthashicorp/consul:2.1hashicorp/consul:2.1.0

digestsha256:259fd02f2544fe1aa03fa49efd3b105c8dd67106d710a72f5e898110266356f7

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-111497 in the brotli-libs package is the one finding that affects the verdict; it is flagged as actively exploited in the wild, but it only matters if a process in this container decodes attacker-supplied Brotli data, which the default Consul agent does not appear to do.• The scan found 34 vulnerabilities reachable from the network in normal operation, and only one of them reaches the 6.0 severity level, with none above that.• Only 1 network-reachable finding is flagged as actively exploited, and its impact is limited to conditional memory corruption rather than a flaw in the Consul agent itself.• The scan also found 18 vulnerabilities that matter only after the container is already compromised, and none of them reach 6.0 severity.• The publisher is verified by the registry and the image is pinned by digest, which lowers supply-chain concerns, though it does not remove the need to patch the brotli-libs package.• The container runs as root by default and the agent is started in development mode with client access on all interfaces, which widens the attack surface regardless of the individual CVEs.

25/100NEEDS ATTENTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main item is CVE-2026-111497 in brotli-libs, which is marked as actively exploited, but it only becomes relevant if something in the container processes untrusted Brotli data, which the default Consul agent does not appear to do. Other findings are of lower severity or only matter after a compromise, so they do not drive the verdict. Updating brotli-libs and reviewing the development-mode startup and root user settings would further reduce exposure.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

52 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-111497	MEDIUM6	brotli-libs 1.2.0-r1 fixed in 1.2.1-r0	82.6% Actively Exploited	Directly Exposed
CVE-2026-107891	MEDIUM4	musl 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2026-107891	MEDIUM4	musl-utils 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed
CVE-2026-92392	LOW2.92	curl 8.22.0-r0 fixed in 8.23.0-r0	1.3% Low-Moderate Risk	Post-Exploit
CVE-2026-92392	LOW2.92	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.3% Low-Moderate Risk	Post-Exploit
CVE-2026-107928	LOW2.88	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-107928	LOW2.88	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-92386	LOW2.58	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-92386	LOW2.58	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-86410	LOW2.45	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-86410	LOW2.45	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-92388	LOW2.34	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-86414	LOW2.34	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-92390	LOW2.34	curl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-92388	LOW2.34	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-86414	LOW2.34	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-92390	LOW2.34	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-107929	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-86415	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-87861	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-87862	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	1.0% Theoretical Threat	Directly Exposed
CVE-2026-87863	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-87864	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-87865	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-87866	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-92387	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	1.0% Low-Moderate Risk	Directly Exposed
CVE-2026-92389	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-92391	LOW2.22	curl 8.22.0-r0 fixed in 8.23.0-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-107929	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-86415	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-87861	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-87862	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.0% Theoretical Threat	Directly Exposed
CVE-2026-87863	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-87864	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-87865	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-87866	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-92387	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.0% Low-Moderate Risk	Directly Exposed
CVE-2026-92389	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-92391	LOW2.22	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-86411	LOW2.12	curl 8.22.0-r0 fixed in 8.23.0-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-86411	LOW2.12	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-94266	LOW1.98	curl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-94266	LOW1.98	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-86409	LOW1.91	curl 8.22.0-r0 fixed in 8.23.0-r0	1.1% Low-Moderate Risk	Post-Exploit
CVE-2026-86412	LOW1.91	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-86413	LOW1.91	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-86409	LOW1.91	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.1% Low-Moderate Risk	Post-Exploit
CVE-2026-86412	LOW1.91	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-86413	LOW1.91	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-94265	LOW1.86	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-94265	LOW1.86	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.