9.9
Critical
CVE-2026-110720 Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding…
Description
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Tooling 0.42 | 0.42.0 → < 2.0.4 | 2.0.4 |
References
- discuss.hashicorp.com discuss.hashicorp.com
Timeline
- Published
- Last modified
Other CVEs of Tooling
The 13 CVEs of Tooling →
CVE-2026-87993
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow…
7.7
High
CVE-2026-8715
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in…
9.6
Critical
CVE-2026-16326
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may…
10.0
Critical
CVE-2026-16328
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied,…
8.6
High