Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an…
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- HashiCorp
- Product
- Tooling
- CVSS v3.1
- 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.004 (p30)
- Fix
- available
- Weakness
- CWE-863
- NVD status
- Received
Why it ranks 25 (Notable)
- CVSS v3.1 9.9 critical
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.