CVE-2026-110720EUVD-2026-110070
Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2.0.4
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Consul-k8s, the Kubernetes integration for HashiCorp Consul, is affected by a flaw in its component ACL binding rules that allows access checks to be bypassed across namespaces. An attacker could exploit this to gain higher Consul privileges than they should have.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
Affected versions
- HashiCorp Tooling
From 0.42.0 · fixed in 2.0.4