$ cat hashicorp/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
Consul closes cross-namespace ACL binding hole
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Operators of consul-k8s multi-namespace deployments should treat the binding change as a breaking default; security bumps and a Stacks policy GA follow.
fix: scope ACL binding rules to release namespace to prevent cross-na… hashicorp/consul-k8s
ACL binding rules written by server-acl-init previously matched on service account name alone; they now also pin the namespace to the Consul release namespace, so a component role can no longer be claimed from another namespace. Existing multi-namespace deployments that relied on the looser match will need to reconcile bindings before upgrading.
v1.8.18 hashicorp/consul-dataplane
The dataplane release moves golang.org/x/net to v0.60.0 and its Go toolchain to 1.26.9 to address security vulnerabilities, with a follow-up to Go 1.26.10 for GO-2026-6809. If you pin the image tag, move to 1.8.18 rather than a rebuild of an earlier tag.
Implement node write locks for serialized catalog writes hashicorp/consul
The new nodeWriteLocks serialize ACL-vetted catalog writes on the leader, keeping authorization and Raft apply atomic for a node's write set. Tests cover concurrent write handling. The subtle consequence is that a client writing the same node concurrently now lands in a serialized path, which is the point.
fix(terminating-gateway): parse string annotations and apply vaultNamespace for CRD-managed gateways hashicorp/consul-k8s
CRD-managed terminating gateways were reconciling wrong on two fronts: documented string annotations broke every TerminatingGateway reconcile, and vaultNamespace from the helm-values ConfigMap was not applied. Deployments using the ConfigMap path should expect the namespace behavior to change once this lands.
connect: revert max supported Envoy from 1.39.4 to 1.39.1 (#24057) hashicorp/consul
Consul reverts its maximum supported Envoy to 1.39.1, undoing the bump to 1.39.4 and restoring the original changelog entry. Anyone who already moved sidecars to 1.39.4 is now above the supported ceiling.
Sort secrets longest-first when redacting hashicorp/packer-plugin-sdk
Redaction iterated over a map, so replacement order was random; with two sensitive values like ubuntu and ubuntu-22.04 the shorter could be replaced first and leave the tail of the longer secret in the log. Secrets are now sorted longest-first. No SDK API changes, but logs from earlier builds may carry fragments you assumed were scrubbed.
feat: authorize every leaf cert request to prevent unauthenticated cached requests hashicorp/consul
Leaf certificate requests are now authorized on every call, closing the case where a cached response was served without re-checking the requester. A Connect deployment issuing high volumes of leaf certs will see the authorization path on each request.
[VAULT-50037] Upgrade dependencies to resolve security vulnerabilities hashicorp/vault-plugin-database-snowflake
Alongside: vault-plugin-database-snowflake, vault-plugin-database-mongodbatlas and vault-plugin-auth-cf all moved x/net to v0.60.0 and x/crypto to v0.58.0 with pgx v5.9.2, the Snowflake plugin shipping as v0.17.1 in Vault 2.2's VAULT-50021 patch; web-unified-docs dropped PKCE references from JWT/OIDC/Azure AD pages until the feature is live, added api.releases.hashicorp.com to its Vault whiteli...
$ ls hashicorp/week/ # the briefings behind this review
Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.