HashiCorp Rectifies Consul Kubernetes Security Vulnerability

HashiCorp has addressed a significant vulnerability in its Consul Kubernetes integration, releasing updates to mitigate a flaw that could allow unauthorized access across Kubernetes namespaces.

Details of the Security Flaw

The issue, identified as CVE-2026-110720, impacts installations employing automated access control list (ACL) management. On October 26, 2026, HashiCorp revealed that updated versions 2.1.0 and 1.8.18 of Consul-k8s are now available to close this security gap.

The vulnerability affects Consul-k8s versions from 0.42.0 to 2.0.4, with 1.8.18 specifically marked as a stable release. Although the flaw is described as critical, the disclosure lacks a formal severity score or CVSS rating.

Impact and Exploitation Risk

The vulnerability arises from insufficient restrictions in ACL binding rules that associate Kubernetes identities with Consul roles. Under specific conditions, these rules could permit identities from other namespaces to access Consul components, potentially leading to unauthorized privilege escalation.

Exploiting this flaw requires the attacker to have permissions to create a ServiceAccount and obtain a token from a different namespace, as well as network access to the Consul API. This limits the vulnerability’s scope to targeted attacks rather than widespread exploitation.

Recommendations and Best Practices

HashiCorp’s advisory, HCSEC-2026-50, clarifies that successful exploitation does not necessarily equate to full administrative control, and no active exploitation or attack code has been reported. Key to mitigation is ensuring the global.acls.manageSystemACLs setting is configured correctly. Deployments without this feature enabled are immune to the flaw.

Users are urged to verify their Consul-k8s version and configuration settings to assess vulnerability. Updating to Consul-k8s versions 2.1.0 or 1.8.18 is strongly recommended. The flaw was reported by security researcher Elias Hasas, known as zer0d4y5 on GitHub.

As enterprises increasingly rely on Kubernetes for their DevOps environments, understanding and managing API access risks is crucial. Comparing this vulnerability to past incidents involving misconfigured DevOps tools underscores the importance of vigilant security practices.