Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

consul-k8s ACL flaw can grant elevated Consul privileges (CVE-2026-110720)

Original title: HashiCorp Consul Vulnerability Allows Attackers to Bypass Authorization and Gain Elevated Privileges

GBHackersby Divya ()2 min read1
Read at gbhackers.com
Part of a story covered by 4 sourcesHashiCorp patches consul-k8s cross-namespace ACL bypass CVE-2026-110720Merged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

An attacker must already create a ServiceAccount in another namespace and reach the Consul API; active exploitation is not confirmed.

HashiCorp advisory HCSEC-2026-50, published October 26, 2026, describes a cross-namespace authorization bypass in consul-k8s when automated system ACL management is enabled. Component ACL binding rules did not consistently limit Kubernetes authentication to the Consul deployment's namespace, so a ServiceAccount elsewhere could receive that component's Consul privileges. Fixes are in 1.8.18 and 2.1.0. The bulletin gives no CVSS score and does not confirm exploitation or full administrative takeover.

Unconfirmed: No CVSS score or exploitation telemetry is provided, and obtainable component privileges are not enumerated.

Key facts
  • Affected versions are consul-k8s 0.42.0 through 2.0.4.
  • Only deployments with global.acls.manageSystemACLs=true are exposed.
  • Patched releases are consul-k8s 1.8.18 and 2.1.0.
  • HashiCorp credited researcher Elias Hasas, GitHub user zer0d4y5.
  • The advisory does not list the privileges each impersonated component would grant.
Security assessment · AI, from the article

Impact: Elevated Consul privileges through an impersonated component identity

ProductAffectedFixed in
HashiCorp consul-k8s0.42.0 to 2.0.4 when global.acls.manageSystemACLs=true1.8.18 and 2.1.0
What to do
  1. 1.Upgrade consul-k8s to 2.1.0 or 1.8.18.
  2. 2.Check whether automated system ACL management is enabled.
  3. 3.Confirm whether other namespaces can create ServiceAccounts that reach the Consul API.
Analyze CVE-2026-110720 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-110720
ATT&CK
T1136 Create AccountT1078 Valid Accounts
Tags
hashicorpconsulconsul-k8skubernetesauthorization-bypassacl
Vendors
HashiCorp
Products
consul-k8sConsul

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-110720
Cross-namespace ACL bypass in Consul-k8s 0.42.0+
9.9—

From the original article

2 min read at gbhackers.com

HashiCorp disclosed a vulnerability in consul-k8s, a cross-namespace authorization bypass that could let attackers with limited Kubernetes permissions gain elevated Consul privileges. This vulnerability is tracked as CVE-2026-110720 and affects component access control list (ACL) binding rules when automated system ACL management is enabled.

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.