HCSEC-2026-50 - Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
// AI summary
Consul-k8s versions 0.42.0 up to 2.0.4 are vulnerable to CVE-2026-110720, a cross-namespace authorization bypass allowing elevated Consul privileges, fixed in 1.8.18 and 2.1.0.
// from the source
Bulletin ID: HCSEC-2026-50 Affected Products / Versions: consul-k8s 0.42.0 up to 2.0.4; fixed in consul-k8s 1.8.18 and 2.1.0 Publication Date: October 26, 2026 Summary Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18. Background When system ACL management is enabled, consul-k8s con