A vulnerability in Consul and Consul Enterprise allows bypassing HTTP header-based access rules when using Headers in Layer 7 traffic intentions. This issue affects versions from 1.9.0 up to but not including 1.20.1. The vulnerability is classified as medium severity. A patch is available to address this issue.