rules-consul

Consul ACL system is disabled. Without ACLs, any agent or client can read and write all keys, services, and intentions — including secrets stored in the KV store. Enable ACLs with 'acl { enabled = true default_policy = "deny" }' and issue fine-grained tokens for each service.

verify_incoming = false disables mutual TLS for incoming Consul RPC and HTTPS connections. Without mTLS, any node on the network can impersonate a Consul server or client. Set verify_incoming = true and provision TLS certificates for all agents.

Hardcoded Consul ACL token or secret ID detected (CWE-798). Tokens embedded in config files or version control can be read by anyone with repo access and give full API access if the ACL policy is broad. Store the token in Vault, HashiCorp Vault Agent, or a secrets manager, and inject it at runtime via environment variable (CONSUL_HTTP_TOKEN).

consul_kv usage detected. Ensure KV paths holding secrets are protected by ACL policies with 'deny' as the default, and prefer Vault for secret storage over the Consul KV store.

Consul gossip encryption key is empty. Without gossip encryption, all agent-to-agent heartbeat and membership messages are transmitted in plaintext. Generate a key with 'consul keygen' and set 'encrypt = "<base64-key>"' in all agent configs.

verify_outgoing = false disables TLS verification for outgoing Consul RPC connections. This allows MITM interception of all intra-cluster traffic, including ACL tokens and KV data. Set verify_outgoing = true and provide a valid CA certificate.