CVE-2026-110720: HashiCorp consul-k8s Admission Webhook Auth Bypass
An admission webhook and service-mesh token validation flaw in HashiCorp consul-k8s allows an attacker with limited pod creation or service-account privileges in a Kubernetes namespace to spoof sidecar injection annotations and impersonate upstream mesh services.
Executive Summary & Technical Impact
An admission webhook and service-mesh token validation flaw in HashiCorp consul-k8s allows an attacker with limited pod creation or service-account privileges in a Kubernetes namespace to spoof sidecar injection annotations and impersonate upstream mesh services.
Tracked under CVE-2026-110720 (CWE-287 (Improper Authentication)), this vulnerability affects consul-k8s 0.42.0 up to 2.0.4 (1.4.x – 1.6.x) and carries a severity score of 8.8 (HIGH). Engineering and security operations teams running Consul on Kubernetes (consul-k8s) should prioritize upgrading to consul-k8s 1.8.18, 2.1.0 (or 1.6.3 / 1.5.5 / 1.4.8).
Remediation & Patch Guidance
- Upgrade consul-k8s control plane components via Helm or consul-k8s CLI to patched versions (1.8.18 / 2.1.0 or patched 1.4–1.6 maintenance builds).
- Audit Kubernetes MutatingWebhookConfiguration and service mesh ACL tokens in multi-tenant clusters.
Frequently Asked Questions (CVE-2026-110720)
What versions are affected by CVE-2026-110720?
CVE-2026-110720 affects consul-k8s 0.42.0 up to 2.0.4 (1.4.x – 1.6.x) in Consul on Kubernetes (consul-k8s) (HashiCorp consul-k8s Admission Webhook Auth Bypass).
How do I patch or remediate CVE-2026-110720?
Upgrade affected deployments to consul-k8s 1.8.18, 2.1.0 (or 1.6.3 / 1.5.5 / 1.4.8) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-110720?
CVE-2026-110720 is rated HIGH with a CVSS score of 8.8 (vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Critical CVEs Hit AI Agent and Cloud Infrastructure: OpenHands SDK RCE, Google MCP Toolbox File Exfiltration, and Consul-k8s ACL Bypass
Three critical advisories published on October 26, 2026 share one lesson: default-open settings in agent sandboxes, MCP servers, and service meshes are an attack surface.
Read full engineering post-mortem (6 min read) →