Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Consul‑k8s may let users gain higher privileges across namespaces

CVE-2026-110720 · published 1 day ago
Summary

Versions of Consul‑k8s from 0.42.0 onward can mistakenly allow someone in one Kubernetes namespace to act with higher rights in another namespace. This could let an attacker get more control over your Consul service. Upgrade to Consul‑k8s 2.1.0 or 1.8.18 to fix the issue.

What to do
  • Update hashicorp tooling to version 1.8.18.
Affected software
VendorProductAffected versions
hashicorp tooling < 2.0.4
Fix: upgrade to 1.8.18
Original advisory text
Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published26 Oct 2026
Updated27 Oct 2026
First seen26 Oct 2026
Sources
CVE-2026-110720 · NVD
CVE-2026-110720 · MITRE
CVE-2026-110720 · OSV
Track software like this
Free during beta