consul-k8s ACL flaw can grant elevated Consul privileges (CVE-2026-110720)
An attacker must already create a ServiceAccount in another namespace and reach the Consul API; active exploitation is not confirmed.
64
Product
Consul
- Mentions · 7d2
- Mentions · 30d2
- All mentions3
- First seenSep 11, 2026
- Last mentioned5d ago
Timeline
3 articles · newest firstHashiCorp Consul auth bypass in service mesh leaf certificate API
Canada’s Cyber Centre urges admins to apply HashiCorp updates for Consul and Consul Enterprise as they become available.
52
HashiCorp security advisory (AV26-910)
Canada's Cyber Centre warns HashiCorp Consul and consul-template have authorization bypass and information disclosure flaws, urging users to apply available updates.
25
Related CVEs
by mentions- Cross-namespace ACL bypass in Consul-k8s 0.42.0+
Appears with
- HashiCorpvendor · 3
- Canadian Centre for Cyber Securityorganization · 2
- Consul Enterpriseproduct · 2
- consul-k8sproduct · 1
- consul-templateproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.