AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

HashiCorpCVE-2026-110720

HashiCorp Tooling: improper authorization

HashiCorp

CVE-2026-110720 · Published Oct 26, 2026 · updated Oct 27, 2026

Critical9.9
Fix: upgrade to 2.0.4 or later
HashiCorp advisory

Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.

Affected versions

PackageAffectedFixed in
Tooling
Product
>= 0.42.0, < 2.0.42.0.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-863

More HashiCorp advisories

All HashiCorp
High 7.5Oct 26HashiCorp Consul: missing authorizationCVE-2026-105765fixed in 2.1.0 +1Medium 6.7Sep 15HashiCorp Shared library: privilege escalationCVE-2026-88922fixed in 2.2.4High 7.7Sep 10HashiCorp Tooling: information disclosureCVE-2026-87993fixed in 0.43.0High 7.1Sep 10Consul and Consul Enterprise are vulnerable to an authorization bypass in the...CVE-2026-88021fixed in 2.0.4 +1High 8.3Sep 10HashiCorp Consul: improper authorizationCVE-2026-87090fixed in 2.0.4 +1Medium 6.5Sep 10HashiCorp Consul: denial of serviceCVE-2026-87106fixed in 2.0.4 +1