Threat Pulse 62High
Consul on Kubernetes flaw (CVSS 9.9) lets another namespace act as Consul
Severity 6PatchedreportedCloud and SaaS

CVE-2026-110720: a ServiceAccount from another namespace can authenticate as a Consul component and take its privileges; consul-k8s 0.42.0 to 2.0.4 affected when system ACLs are managed.

What to do: Upgrade consul-k8s to 2.0.4.

· 9 days ago · cve.now on X
Sourcescve.now on X
On X
@cvedotnowverifiedOct 26, 19:02 UTC

CVE-2026-110720, HashiCorp consul-k8s >=0.42.0 <2.0.4: a flaw in its component ACL binding rules allows access checks to be bypassed across namespaces. CVSS 9.9. Fix: 2.0.4

Open on X
Why this score

Plan rubric with caps (verified sweep, Oct 26)

Back to the board

Updated Nov 5, 01:48 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.