CVE-2026-16326

Received Received - Intake

Session State Isolation Bypass in Consul MCP Server

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: HashiCorp Inc.

Description

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-16326

Affected Vendors & Products

Vendor	Product	Version / Range
hashicorp	consul_mcp_server	to 0.1.3 (inc)
hashicorp	consul_mcp_server	0.1.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-488	The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

Executive Summary

In consul-mcp-server versions 0.1.0 to 0.1.3, session state was not properly isolated in stateless mode. This allowed one client's Consul authentication token to be reused by other clients for subsequent requests.

Detection Guidance

This vulnerability is specific to consul-mcp-server versions 0.1.0 to 0.1.3 and involves improper session state isolation in stateless mode. Detection requires checking the version of consul-mcp-server running on your system. If you are running version 0.1.0 to 0.1.3, the system is vulnerable.

Impact Analysis

An attacker could gain unauthorized access to Consul resources by reusing a valid authentication token from another client. This could lead to data breaches, unauthorized actions, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies

Upgrade consul-mcp-server to version 0.1.4 or later to address the session state isolation issue.

Hi! I’m here to help you understand CVE-2026-16326. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70