CVE-2026-110720 PUBLISHED

Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

Assigner: HashiCorp
Reserved: 14.10.2026 Published: 26.10.2026 Updated: 26.10.2026

Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	HashiCorp
Product	Tooling
Versions	Default: unaffected affected from 0.42.0 to 2.0.4 (excl.)

Credits

This issue was reported to HashiCorp by Elias Hasas (GitHub: zer0d4y5).

References

https://discuss.hashicorp.com/t/hcsec-2026-50-consul-k8s-vulnerable-to-a-cross-namespace-authorization-bypass-in-component-acl-binding-rules/77915

Problem Types

CWE-863: Incorrect Authorization CWE

Impacts

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs