Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-16326

consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Tooling

Default version status: unaffected

  • 0.1.0 to < 0.1.4affected

References