CVE-2026-1107209.9Critical
Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
HashiCorp · Tooling
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
9.9CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 27 Oct.
- HashiCorp patches critical Consul Kubernetes authorisation bypassSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.