Cross-tenant credential reuse in HashiCorp Consul MCP Server (CVE-2026-16326)

consul-mcp-server versions 0.1.0 through 0.1.3 did not correctly isolate per-client session state when operating in stateless mode. This flaw may allow an authenticated Consul client belonging to one session to be reused for requests from a different client, resulting in tool calls being executed using another client's Consul token. Only deployments running in stateless mode with more than one connected client are affected; stateful mode deployments are not impacted. Affected versions: - 0.1.0 up to 0.1.3 We recommend updating to: 0.1.4. CVSS 10.0 · our assessment: act_now Reference: https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612 Details: https://vuln.today/cve/CVE-2026-16326