CVE-2026-110720: Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Received
Published 26-10-2026Last modified 26-10-2026
Vulnerability summary
CVE-2026-110720 is a critical (CVSS 9.9) Incorrect Authorization vulnerability in hashicorp tooling.
CVSS score
9.9/10
010
Critical · v3.1 (CVE.org)EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 26-10-2026PublishedVulnerability first disclosed.
- 26-10-2026Last modifiedVulnerability information updated.
Description
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Hashicorp1 product
- tooling≥ 0.42.0, < 2.0.4
1 vendor · 1 product