Loading vulnerability…
Cross-namespace authorization bypass in HashiCorp Consul-k8s
CVE-2026-110720 is a cross-namespace authorization bypass in HashiCorp Consul-k8s component ACL binding rules. When automated system ACL management is enabled, Consul-k8s generates Kubernetes authentication and binding rules that associate component ServiceAccounts with Consul roles. Vulnerable rules do not consistently restrict authentication to ServiceAccounts in the Kubernetes namespace hosting Consul, allowing an identity from another namespace to authenticate as a Consul component and obtain its associated privileges. Affected releases begin at 0.42.0; fixed releases are 1.8.18 and 2.1.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can cross the intended Kubernetes namespace authorization boundary and gain elevated Consul privileges associated with an impersonated component. The resulting confidentiality, integrity, and availability impacts depend on that component's assigned permissions; successful exploitation does not necessarily provide full Consul administrative access.
If you can’t patch tonight, do this now.
No temporary workaround is explicitly recommended. Deployments with automated system ACL management disabled are not vulnerable.
Patch, then assume compromise.
Upgrade Consul-k8s to fixed version 1.8.18 or 2.1.0, as appropriate for the deployed release branch. Assess exposure by checking both the installed Consul-k8s version and whether global.acls.manageSystemACLs is enabled.
1 exploit validated by Mallory's analysis.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.