Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges

A critical authorization bypass vulnerability (CVE-2026-110720) in HashiCorp's Consul-k8s component allows attackers with limited Kubernetes permissions to escalate privileges across namespace boundaries within Consul. The flaw exploits weaknesses in how ACL management interacts with Kubernetes namespace isolation, undermining a fundamental security boundary that administrators rely on to segregate workloads. This matters because Kubernetes environments often host multiple teams or sensitive services in separate namespaces, and a privilege escalation of this kind can allow lateral movement across the entire service mesh. Timely patching and strict access controls on the Consul API surface are essential to preventing exploitation.