by Kastro
Paper/Archive/CVE-2026-16326

CVE-2026-16326

HashiCorp Tooling — consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

EPSS 0.5%CVSS 10.0
critical.is priorityof 100
39
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 45.3.453 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

Affected

ProductAffectedFixed inSource
Tooling0.1.0 – < 0.1.40.1.4CNA

Scores by source

HashiCorp (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refdiscuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612