[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhwyr8WyIMyy9Da0HbmyFta4N69GOK8J79oYBxSJhe3Q":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"3dba2161-9e70-462c-9954-abdd921354d5","Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges","critical-hashicorp-consul-kubernetes-flaw-allows-attackers-to-gain-elevated-priv-be19be","HashiCorp has released fixes for a Consul-k8s authorization bypass that could allow an attacker to gain elevated Consul privileges from another Kubernetes namespace. Tracked as CVE-2026-110720, the flaw affects deployments using automated system access control list management. HashiCorp disclosed the issue on October 26, 2026, and identified Consul-k8s 2.1.0 and 1.8.18 as patched releases. The […] The post Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges appeared first on Cyber Security News.","HashiCorp has released patches for a critical authorization bypass vulnerability (CVE-2026-110720) in Consul-k8s. The flaw allows attackers with specific Kubernetes permissions to gain elevated Consul privileges from different namespaces. Exploitation requires the system ACL management to be enabled and network access to the Consul API.","HashiCorp Consul Kubernetes flaw allows elevated privileges via authorization bypass.","https:\u002F\u002Fcybersecuritynews.com\u002Fhashicorp-consul-kubernetes-vulnerability\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FHashiCorp-Patches-Critical-Consul-k8s-Authorization-Bypass-Vulnerability.webp","2026-10-27T11:37:34+00:00","2026-10-27T12:00:06.962053+00:00",8,[17,20,23],{"name":18,"type":19},"Consul-k8s","product",{"name":21,"type":22},"HashiCorp","vendor",{"name":24,"type":25},"Kubernetes","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":47,"context":48},"cve","CVE-2026-110720","HashiCorp Consul Kubernetes authorization bypass vulnerability",[21,18],{"controls":51,"vendors":138},[52,81,109],{"slug":53,"name":54,"problem":55,"products":56},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,94,101],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":82,"product_name":98,"url":99,"description":100},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":110,"name":111,"problem":112,"products":113},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[139],{"slug":140,"name":21,"logo_path":141,"roles":142},"hashicorp","\u002Fvendor-logos\u002Fhashicorp.png",[143,144],"affected","reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"critical-consul-k8s-flaw-enables-cross-namespace-privilege-escalation","Critical Consul-k8s Flaw Enables Cross-Namespace Privilege Escalation","A critical authorization bypass vulnerability (CVE-2026-110720) in HashiCorp's Consul-k8s component allows attackers with limited Kubernetes permissions to escalate privileges across namespace boundaries within Consul. The flaw exploits weaknesses in how ACL management interacts with Kubernetes namespace isolation, undermining a fundamental security boundary that administrators rely on to segregate workloads. This matters because Kubernetes environments often host multiple teams or sensitive services in separate namespaces, and a privilege escalation of this kind can allow lateral movement across the entire service mesh. Timely patching and strict access controls on the Consul API surface are essential to preventing exploitation.",[150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":158,"PCI DSS Requirement 6":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"OWASP A06:2021 Vulnerable and Outdated Components":161,"CIS Control 7: Continuous Vulnerability Management":162,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":163,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":164},"NIS2 requires entities to implement measures covering incident handling and vulnerability management; this obligation would compel operators of critical services using Consul-k8s to assess and remediate the authorization bypass as part of their mandatory security hygiene.","Requirement 6 mandates the development and maintenance of secure systems by applying security patches promptly; environments processing card data running Consul-k8s would be obligated to patch critical flaws within defined timelines, limiting exposure.","SI-2 mandates identifying, reporting, and correcting information system flaws in a timely manner; adherence would have driven rapid deployment of HashiCorp's patch before attackers could exploit the authorization bypass.","This risk category specifically addresses the danger of using components with known vulnerabilities; maintaining an inventory of Consul-k8s versions and monitoring for security advisories would have surfaced the need to upgrade before exploitation.","This control requires organizations to continuously track and remediate vulnerabilities; applying it would have ensured CVE-2026-110720 was patched promptly after HashiCorp's advisory was published, closing the exploitation window.","This control requires organizations to obtain information about technical vulnerabilities and take timely action; a compliant process would have identified CVE-2026-110720 and triggered immediate patching of the affected Consul-k8s component.","This outcome requires that access to systems and data is limited to authorized users and processes; enforcing strict Consul ACL policies and Kubernetes RBAC would have prevented cross-namespace privilege escalation even if the vulnerability existed."]