HashiCorp patches Consul-k8s cross-namespace ACL bypass (CVE-2026-110720)
Versions 0.42.0 through 2.0.4 are affected only with system ACL management on; fixes are 1.8.18 and 2.1.0.
Stories per day · 30 days
Relatedauthorization-bypass3hashicorp3kubernetes2acl1certificate1consul-k8s1privilege-escalation1service-mesh1
4 stories, newest first · one card per story
Stories tagged #consul
consul-k8s ACL flaw can grant elevated Consul privileges (CVE-2026-110720)
An attacker must already create a ServiceAccount in another namespace and reach the Consul API; active exploitation is not confirmed.
HashiCorp Consul auth bypass in service mesh leaf certificate API
Canada’s Cyber Centre urges admins to apply HashiCorp updates for Consul and Consul Enterprise as they become available.
HashiCorp security advisory (AV26-910)
Canada's Cyber Centre warns HashiCorp Consul and consul-template have authorization bypass and information disclosure flaws, urging users to apply available updates.