Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1084
_____________________________________________________________________

DATE                : 27/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running consul-k8s versions prior to
                                   1.8.18, 2.1.0.

====================================================================
https://discuss.hashicorp.com/t/hcsec-2026-50-consul-k8s-vulnerable-to-a-cross-namespace-authorization-bypass-in-component-acl-binding-rules/77915
_____________________________________________________________________
 
HCSEC-2026-50 - Consul-k8s vulnerable to a cross-namespace
authorization bypass in component ACL binding rules

Security     security-consul
Oct 26

james.warren 

Bulletin ID: HCSEC-2026-50

Affected Products / Versions: consul-k8s 0.42.0 up to 2.0.4; fixed
in consul-k8s 1.8.18 and 2.1.0

Publication Date: October 26, 2026

Summary

Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace
authorization bypass in component ACL binding rules that may allow an
attacker to obtain elevated Consul privileges. This vulnerability
(CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.


Background

When system ACL management is enabled, consul-k8s configures Kubernetes
authentication and Consul ACL binding rules so its components can obtain
Consul tokens. These rules are intended to associate component Kubernetes
ServiceAccounts with their corresponding Consul roles.


Details

Component binding rules did not consistently restrict authentication to
ServiceAccounts in the Consul deployment’s Kubernetes namespace. An
attacker with Kubernetes permissions to create a ServiceAccount and obtain
its token in another namespace, as well as network access to the Consul
API, may be able to authenticate as a Consul component and obtain its
associated privileges. This issue affects deployments with
global.acls.manageSystemACLs=true; deployments with system ACL management
disabled are not vulnerable.


Remediation

Customers should evaluate the risk associated with this issue and consider
upgrading to consul-k8s 2.1.0 or 1.8.18.


Acknowledgement

This issue was reported to HashiCorp by Elias Hasas (GitHub: zer0d4y5).

We deeply appreciate any effort to coordinate disclosure of security
vulnerabilities. For information about security at HashiCorp and the
reporting of security vulnerabilities, please see
https://hashicorp.com/security.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================