CVE-2026-110720 with a CVSS score of 9.9 is a critical cross-namespace authorization bypass in the component Access Control List (ACL) binding rules of consul-k8s, the Kubernetes integration for Consul that supports service mesh, service discovery, and API gateway functionality. The flaw is an incorrect authorization weakness, classified as CWE-863, where ACL binding rules for internal components fail to properly restrict authorization checks across Kubernetes namespaces. An authenticated attacker with low privileges on the network can exploit the bypass without user interaction by abusing permissive component ACL binding rules across a changed security scope, obtaining elevated Consul privileges and compromising the broader service mesh. Affected versions start from 0.42.0 and continue through later vulnerable releases, while versions prior to 0.42.0 are unaffected. The issue affects Linux, Windows, and macOS platforms. Business impact is severe because multi-tenant Kubernetes clusters can suffer privilege escalation across namespace boundaries, with successful exploitation causing total impact across confidentiality, integrity, and availability for service discovery, mesh control, and gateway operations.
We recommend you to update consul-k8s to version 2.1.0, 2.0.4, or 1.8.18.[/subscribe_to_unlock_form]
CVE-2026-110720 with a CVSS score of 9.9 is a critical cross-namespace authorization bypass in the component Access Control List (ACL) binding rules of consul-k8s, the Kubernetes integration for Consul that supports service mesh, service discovery, and API gateway functionality. The flaw is an incorrect authorization weakness, classified as CWE-863, where ACL binding rules for internal components fail to properly restrict authorization checks across Kubernetes namespaces. An authenticated attacker with low privileges on the network can exploit the bypass without user interaction by abusing permissive component ACL binding rules across a changed security scope, obtaining elevated Consul privileges and compromising the broader service mesh. Affected versions start from 0.42.0 and continue through later vulnerable releases, while versions prior to 0.42.0 are unaffected. The issue affects Linux, Windows, and macOS platforms. Business impact is severe because multi-tenant Kubernetes clusters can suffer privilege escalation across namespace boundaries, with successful exploitation causing total impact across confidentiality, integrity, and availability for service discovery, mesh control, and gateway operations.
We recommend you to update consul-k8s to version 2.1.0, 2.0.4, or 1.8.18.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]