HashiCorp patches Consul-k8s cross-namespace ACL bypass (CVE-2026-110720)
Original title: Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges
Versions 0.42.0 through 2.0.4 are affected only with system ACL management on; fixes are 1.8.18 and 2.1.0.
HashiCorp fixed CVE-2026-110720, an authorization bypass in Consul-k8s disclosed on October 26, 2026. With system ACL management enabled, binding rules did not always restrict authentication to ServiceAccounts in the Consul namespace, so another namespace's identity could receive a component's Consul privileges. The attacker needs rights to create a ServiceAccount and obtain its token, plus network access to the Consul API. No exploit code or confirmed attacks were described. Deployments with that setting disabled are not affected.
Unconfirmed: The article calls the flaw critical, but HashiCorp's bulletin states no severity rating.
- Patched releases named are Consul-k8s 2.1.0 and 1.8.18.
- The bulletin gives no CVSS score, despite the article's critical headline.
- HashiCorp says success does not necessarily grant full administrative access.
- Elias Hasas, GitHub user zer0d4y5, reported the issue as HCSEC-2026-50.
Impact: Consul component privileges from another Kubernetes namespace
| Product | Affected | Fixed in |
|---|---|---|
| HashiCorp Consul-k8s | 0.42.0 through 2.0.4 | 1.8.18 and 2.1.0 |
- 1.Upgrade Consul-k8s to 2.1.0 or 1.8.18.
- 2.Check whether global.acls.manageSystemACLs is enabled.
- CVEs
- CVE-2026-110720
- Vendors
- HashiCorp
- Products
- Consul-k8s
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110720 | Cross-namespace ACL bypass in Consul-k8s 0.42.0+ | 9.9 | — |
From the original article
2 min read at cybersecuritynews.com
HashiCorp has released fixes for a Consul-k8s authorization bypass that could allow an attacker to gain elevated Consul privileges from another Kubernetes namespace. Tracked as CVE-2026-110720, the flaw affects deployments using automated system access control list management. HashiCorp disclosed the issue on October 26, 2026, and identified Consul-k8s 2.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.