Authorization-Bypass

vulnerabilities 2026-10-29
CVE-2026-110720: Consul-k8s Cross-Namespace ACL Binding Bypass Lets Rogue ServiceAccounts Impersonate Consul Components
HashiCorp's HCSEC-2026-50 fixes an incorrect-authorization flaw in consul-k8s component ACL binding rules that lets a ServiceAccount in any namespace authenticate as a Consul component.
kubernetes authorization-bypass privilege-escalation hashicorp service-mesh cloud

CVE-2026-110720: Consul-k8s Cross-Namespace ACL Binding Bypass Lets Rogue ServiceAccounts Impersonate Consul Components