{"id":"CVE-2026-110720","published":"2026-10-26T19:16:29.940","lastModified":"2026-10-26T20:17:49.013","description":"Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-50-consul-k8s-vulnerable-to-a-cross-namespace-authorization-bypass-in-component-acl-binding-rules/77915","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A cross-namespace authorization bypass in consul-k8s ACL binding rules allows authenticated low-privilege users to obtain elevated Consul privileges by escaping namespace restrictions.","exploitability":"Exploitation requires valid Consul credentials (PR:L) and no user interaction; the flaw is trivially exploitable once the attacker has access to a vulnerable consul-k8s deployment.","blast_radius":"Successful exploitation grants attackers elevated privileges in Consul, enabling full compromise of confidentiality, integrity, and availability across namespaces and potentially the entire service mesh.","remediation":"Upgrade consul-k8s to version 2.1.0 or 1.8.18 (or later patch releases).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","kubernetes","consul","cwe-863","elevation-of-privilege"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:45:25.816Z"}}