What’s Vulnerable › Vulnerabilities
CVE-2026-110720: Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-26 · updated 2026-10-27
- Weakness: CWE-863
Description
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
Summary
Consul-k8s versions 0.42.0 and later contain a cross-namespace authorization bypass in component ACL binding rules, which could let an attacker gain elevated Consul privileges. Rated CVSS 9.9 (critical), it affects HashiCorp Tooling deployments using the vulnerable consul-k8s releases. It is not in CISA KEV and no exploitation has been reported. Upgrade to consul-k8s 2.1.0 or 1.8.18 (HashiCorp Tooling fixed in 2.0.4) to remediate.
تحتوي إصدارات Consul-k8s من 0.42.0 وما بعدها على ثغرة تجاوز تفويض عبر مساحات الأسماء (cross-namespace) في قواعد ربط ACL للمكوّنات، وقد تتيح للمهاجم الحصول على صلاحيات Consul مرتفعة. صُنّفت الثغرة بدرجة 9.9 (حرجة) وتؤثر في عمليات نشر HashiCorp Tooling التي تستخدم إصدارات consul-k8s المتأثرة. لا ترد الثغرة في قائمة CISA KEV ولم يُبلَّغ عن أي استغلال فعلي لها. يُنصح بالترقية إلى consul-k8s 2.1.0 أو 1.8.18 (مع إصلاح HashiCorp Tooling في 2.0.4) لمعالجة المشكلة.
Affected products
- HashiCorp Tooling: from 0.42.0 before 2.0.4 — fixed in 2.0.4
How to fix
Upgrade to a fixed version: HashiCorp Tooling 2.0.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-110720 or the next vulnerability affects your stack