Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges

What happened?

HashiCorp has released fixes for a Consul-k8s authorization bypass that could allow an attacker to gain elevated Consul privileges from another Kubernetes namespace. Tracked as CVE-2026-110720, the flaw affects deployments using automated system access control list management. HashiCorp disclosed the issue on October 26, 2026, and identified Consul-k8s 2.1.0 and 1.8.18 as patched releases. The official security advisory lists the affected range as versions 0.42.0 through 2.0.4, with 1.8.18 available as a fixed release.

Key details

• HashiCorp fixed an authorization bypass in Consul-k8s that lets an attacker gain elevated Consul privileges from another Kubernetes namespace.
• Binding rules did not consistently limit authentication to ServiceAccounts inside the Consul deployment namespace, allowing cross-namespace impersonation.
• Exploitation requires Kubernetes permissions to create a ServiceAccount in another namespace and network access to the Consul API.
• Deployments with system ACL management disabled are not vulnerable to this issue.
• HashiCorp credits security researcher Elias Hasas (zer0d4y5) for reporting the flaw and advises upgrading to Consul-k8s 2.1.0 or 1.8.18.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.