HashiCorp Patches Critical 9.9 CVSS Consul-k8s Authorization Bypass Vulnerability (CVE-2026-110720)

TL;DR

HashiCorp disclosed a critical consul-k8s vulnerability on October 26, 2026, tracked as CVE-2026-110720 with a 9.9 CVSS v3.1 score. The flaw stems from a cross-namespace authorization bypass in component Access Control List (ACL) binding rules. As a result, attackers can gain elevated Consul privileges. Administrators must upgrade their Kubernetes integrations to fixed releases immediately.

Why It Matters

Consul-k8s is the official Kubernetes integration for HashiCorp Consul and enables service mesh, service discovery, and API gateway functionality across container clusters. The exact affected installation counts are not specified in the vendor advisory. However, the official consul-k8s GitHub repository has over 900 stars. It also powers thousands of enterprise Kubernetes environments.

Leaving this consul-k8s vulnerability unpatched puts multi-tenant Kubernetes clusters at severe risk of privilege escalation across namespace boundaries. Furthermore, CISA coordinator assessments confirm that the technical impact of a successful exploit is total across confidentiality, integrity, and availability. Currently, no public proof-of-concept exploit exists, and no active exploitation in the wild has been confirmed.

How the Attack Works

According to the security advisory and NVD disclosures, the flaw is classified as an incorrect authorization weakness (CWE-863).

Cross-Namespace ACL Binding Rule Bypass

When consul-k8s configures Access Control List (ACL) binding rules for internal components, it fails to properly restrict authorization checks across Kubernetes namespaces. Consequently, an authenticated attacker with low privileges on the network can exploit this cross-namespace authorization bypass without any user interaction. Moreover, by abusing the permissive component ACL binding rules across a changed security scope, the attacker can obtain elevated Consul privileges. In turn, they can compromise the broader service mesh.

Affected Versions

This consul-k8s vulnerability affects versions starting from 0.42.0 up to versions prior to the patched 1.8.18, 2.0.4, and 2.1.0 releases across Linux, Windows, and macOS platforms. Versions prior to 0.42.0 are unaffected.

Patch and Mitigation Steps

HashiCorp resolved CVE-2026-110720 in consul-k8s versions 2.1.0, 2.0.4, and 1.8.18. Cluster operators should upgrade their consul-k8s Helm charts or CLI deployments to one of these patched releases immediately. In addition, security teams should audit existing Consul ACL binding rules. Teams should also restrict Kubernetes namespace creation and service account permissions to trusted principals.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.