Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

HashiCorp patches consul-k8s cross-namespace ACL bypass CVE-2026-110720

3 sources · 4 articlesFirst reported Updated ()
What's new

October 27 coverage restated the October 26 advisory; no later report in this story adds a CVSS score, exploit, or confirmed attacks.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

HashiCorp fixed consul-k8s CVE-2026-110720; exploitation is unconfirmed and no CVSS score was published.

HashiCorp advisory HCSEC-2026-50, published October 26, 2026, describes a cross-namespace authorization bypass in consul-k8s when automated system ACL management is enabled. Component ACL binding rules did not consistently limit Kubernetes authentication to the Consul deployment’s namespace, so a ServiceAccount created elsewhere could receive that component’s Consul privileges. An attacker must already be able to create a ServiceAccount in another namespace, obtain its token, and reach the Consul API. Affected releases are consul-k8s 0.42.0 through 2.0.4; fixes are 1.8.18 and 2.1.0. The bulletin gives no CVSS score. HashiCorp says success does not necessarily grant full administrative access, and neither outlet reports exploit code or confirmed attacks.

Key facts
  • CVE-2026-110720 is HashiCorp advisory HCSEC-2026-50.
  • Affected consul-k8s versions are 0.42.0 through 2.0.4.
  • Only deployments with global.acls.manageSystemACLs=true are exposed.
  • Patched releases are consul-k8s 1.8.18 and 2.1.0.
  • Attacker needs a foreign ServiceAccount, its token, and Consul API access.
  • Elias Hasas (GitHub zer0d4y5) reported the issue; no CVSS or confirmed attacks.
Analyze CVE-2026-110720 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 26, 2026HashiCorp published HCSEC-2026-50 for consul-k8s · GBHackers

What each outlet adds

beyond the shared facts
  • GBHackersNames the ACL setting, version range, and researcher credit.
  • Cyber Security NewsNotes no CVSS despite a critical headline and limited admin impact.
CVEs
CVE-2026-110720
Vendors
HashiCorp
Products
NomadNomad EnterpriseBoundaryBoundary Enterpriseconsul-k8sConsulConsul-k8sConsul Enterprise
Organizations
Canadian Centre for Cyber Security
Countries
Canada

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Canadian Centre for Cyber SecurityFirst report

    HashiCorp Consul auth bypass in service mesh leaf certificate API

    Canada’s Cyber Centre urges admins to apply HashiCorp updates for Consul and Consul Enterprise as they become available.

  2. · 3d ago GBHackers

    consul-k8s ACL flaw can grant elevated Consul privileges (CVE-2026-110720)

    An attacker must already create a ServiceAccount in another namespace and reach the Consul API; active exploitation is not confirmed.

  3. · 3d ago Cyber Security News

    HashiCorp patches Consul-k8s cross-namespace ACL bypass (CVE-2026-110720)

    Versions 0.42.0 through 2.0.4 are affected only with system ACL management on; fixes are 1.8.18 and 2.1.0.

  4. · 9h ago Canadian Centre for Cyber Security

    HashiCorp Nomad symlink escape and Boundary SSRF disclosed

    Nomad dispatch writes can leave the allocation directory via symlinks, and Boundary has SSRF in its Vault credential store.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-110720
Cross-namespace ACL bypass in Consul-k8s 0.42.0+
9.9—