CVE-2026-16326CWE-488

CVE-2026-16326

Critical · published July 29, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00537 · 44.5th percentile
Weakness
CWE-488 · Exposure of Data Element to Wrong Session
Published
2026-07-29T23:16Z
References (1)
https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612 · [email protected]
EPSS history
Timeline
  • 29 JUL 18:40Z
    consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
    cvelistv5