CVE-2026-16326

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) En consul-mcp-server, las versiones 0.1.0 hasta la 0.1.3 no aislaron correctamente el estado de la sesión en modo sin estado, lo que podría permitir que el token de autenticación de Consul de un cliente se utilizara para solicitudes posteriores de otros clientes. Esta vulnerabilidad (CVE-2026-16326) está corregida en consul-mcp-server 0.1.4.

Information

Published : 2026-07-29 19:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-16326

Mitre link : CVE-2026-16326

CVE.ORG link : CVE-2026-16326

JSON object : View

Products Affected

No product.

CWE

CWE-488

Exposure of Data Element to Wrong Session

{"id": "CVE-2026-16326", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16326", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T19:10:01.220224Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@hashicorp.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@hashicorp.com", "affectedData": [{"repo": "https://github.com/hashicorp/consul-mcp-server", "vendor": "HashiCorp", "product": "Tooling", "versions": [{"status": "affected", "version": "0.1.0", "lessThan": "0.1.4", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-07-29T19:16:44.900", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612", "source": "security@hashicorp.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@hashicorp.com", "description": [{"lang": "en", "value": "CWE-488"}]}], "descriptions": [{"lang": "en", "value": "In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4."}, {"lang": "es", "value": "En consul-mcp-server, las versiones 0.1.0 hasta la 0.1.3 no aislaron correctamente el estado de la sesi\u00f3n en modo sin estado, lo que podr\u00eda permitir que el token de autenticaci\u00f3n de Consul de un cliente se utilizara para solicitudes posteriores de otros clientes. Esta vulnerabilidad (CVE-2026-16326) est\u00e1 corregida en consul-mcp-server 0.1.4."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "security@hashicorp.com"}