HCSEC-2026-50 - Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

Bulletin ID: HCSEC-2026-50 Affected Products / Versions: consul-k8s 0.42.0 up to 2.0.4; fixed in consul-k8s 1.8.18 and 2.1.0 Publication Date: October 26, 2026 Summary Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18. Background When system ACL management is enabled, consul-k8s configures Kubernetes authentication and Consul ACL binding rules so its components can obtain Consul tokens. These rules are intended to associate component Kubernetes ServiceAccounts with their corresponding Consul roles. Details Component binding rules did not consistently restrict authentication to ServiceAccounts in the Consul deployment’s Kubernetes namespace. An attacker with Kubernetes permissions to create a ServiceAccount and obtain its token in another namespace, as well as network access to the Consul API, may be able to authenticate as a Consul component and obtain its associated privileges. This issue affects deployments with global.acls.manageSystemACLs=true; deployments with system ACL management disabled are not vulnerable. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to consul-k8s 2.1.0 or 1.8.18. Acknowledgement This issue was reported to HashiCorp by Elias Hasas (GitHub: zer0d4y5). We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security. 1 post - 1 participant Read full topic