CVE-2026-16326 — consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

CVE-2026-16326

consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode PUBLISHED

Description (CNA)

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Tooling	affected 0.1.0 before 0.1.4

CWE

CWE-488

References

https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.