---
title: Severe vulnerability found in consul-k8s tool for Kubernetes
url: https://www.dataloco.com/en/severe-vulnerability-found-in-consul-k8s-tool-for-kubernetes
published: 2026-10-30T17:20:37+00:00
language: en
section: Security
source: https://www.security-next.com/192027
organizations: consul, consul-k8s, kubernetes
publisher: Dataloco
---

# Severe vulnerability found in consul-k8s tool for Kubernetes

A severe vulnerability has been identified in the consul-k8s tool, which integrates Kubernetes with Consul. An update has been released to address this issue.

On October 26, 2026, HashiCorp published a security advisory regarding the authorization processing vulnerability identified as CVE-2026-110720. This vulnerability arises from deficiencies in access control rules for components, leading to improper restrictions on authenticated subjects within the Kubernetes namespace where Consul is deployed. This could allow the use of service accounts with the same name in different Kubernetes namespaces to authenticate as Consul components and acquire associated permissions.

Access to the Consul API is required, as well as permissions to create service accounts in a different namespace and obtain tokens. Environments where system ACL management is disabled are not affected.

The Common Vulnerability Scoring System (CVSSv3.1) has assigned a base score of 9.9 to this vulnerability, classifying it as Critical on a four-level severity scale.

HashiCorp has released version 2.1.0 of consul-k8s and version 1.8.18 as bug fixes. Users are urged to evaluate the risks and consider updating their systems accordingly.

## This story in other languages

- [Svenska](https://www.dataloco.com/sv/allvarlig-sarbarhet-upptackt-i-verktyget-consul-k8s-for-kubernetes)
- [Español](https://www.dataloco.com/es/se-revela-vulnerabilidad-critica-en-consul-k8s-para-kubernetes)
- [Português (Brasil)](https://www.dataloco.com/pt-br/vulnerabilidade-critica-encontrada-no-consul-k8s)
- [Français](https://www.dataloco.com/fr/vulnerabilite-grave-dans-loutil-consul-k8s-pour-kubernetes)
- [Norsk](https://www.dataloco.com/no/kubernetes-verktoyet-consul-k8s-har-fatt-en-alvorlig-sarbarhet)