Consul‑k8s 0.42.0 and later contain a flaw that allows a cross‑namespace authorization bypass through component ACL binding rules. This vulnerability, identified as CVE‑2026‑110720, can lead to elevated Consul privileges if an attacker can create or modify ACLs that span namespaces. Based on the description, it is inferred that the attack vector requires the attacker to have access to the cluster’s API to influence ACL bindings, implying a potential privilege escalation scenario within the Consul service.

Affected products include HashiCorp Consul‑k8s versions 0.42.0 through and beyond. The security notice specifies that the issue is addressed in Consul‑k8s 2.1.0 and 1.8.18. Users of earlier releases or those still on 0.42.0 and later versions are at risk.

The CVSS score of 9.9 indicates critical severity, though no EPSS score is available and the vulnerability is not listed in CISA KEV. Exploitation requires manipulating ACL bindings across namespaces, which can grant higher access than intended. If this bypass is achieved, an attacker can potentially read secrets, alter configuration, and interfere with cluster operations, resulting in a broad compromise of confidentiality, integrity, and availability.