BIT-consul-2026-16326

vendorUSosv

consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

view advisory published 2026-08-17Licence: per source

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-16326US	—	0.54% (45th)	—	2026-07-29
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for s…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-16326WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan