Live › vulnerability › CVE-2026-110720
Go to dashboardConsul-k8s, the Kubernetes integration for HashiCorp Consul, has a cross-namespace authorization bypass in its component ACL binding rules. An attacker can obtain elevated Consul privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 19:32 UTC. All times on this page are UTC.
Teams running consul-k8s 0.42.0 or later on Kubernetes with Consul ACLs enabled are exposed, since the flaw is in how component ACL binding rules cross namespaces. Clusters on earlier releases or without Consul ACLs are not described as affected.
No product ranges from the sources yet.
consul-k8s version or the image tag of the consul-k8s controller deployment.0.42.0 or later and below the fixed releases.2.1.0 (or 1.8.18 on the 1.8 line).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
This page as .md · .json · in your agent: get_signal("CVE-2026-110720")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.