Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-16326: Consul MCP Server Exposes Client Credentials in Stateless Mode
CVE-2026-16326 · published 3 months ago
Summary
A security issue in Consul MCP Server versions 0.1.0 to 0.1.3 allows one client's login credentials to be used by other clients. This means unauthorized access to your Consul data is possible. Update to version 0.1.4 to fix the issue.
What to do
- Update consul to version 0.1.4.
- Update hashicorp tooling to version 0.1.4 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | hashicorp | tooling | < 0.1.4 |
| Bitnami | – | consul |
>= 0.1.0, < 0.1.4 Fix: upgrade to 0.1.4
|
Original advisory text
consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.
References
- https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting... URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-16326 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16326... Vendor Advisory
- https://github.com/hashicorp/consul-mcp-server Product
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-488Exposure of Data Element to Wrong Session
Timeline
Published29 Jul 2026
Updated4 Nov 2026
First seen29 Jul 2026
Sources
CVE-2026-16326 · NVD
CVE-2026-16326 · MITRE
BIT-consul-2026-16326 · OSV
CVE-2026-16326 · OSV
Track software like this
Free during beta