consul-mcp-server CVE-2026-16326

Exploitation requires the consul-mcp-server (versions 0.1.0-0.1.3) to be deployed in stateless mode serving multiple clients, AND at least one other client to have already supplied a valid Consul authentication token that lands in the improperly-isolated shared state; the attacker then reuses that token via ordinary MCP requests. Limiting factors: single-client or stateful/session-scoped deployments are not exploitable, the attacker must have network reachability to the same server instance, and the value obtained is bounded by the victim token's Consul ACL policy scope. The attacker itself needs no credentials (PR:N), but the attack is not possible against a default single-tenant or stateful configuration.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L = 10.0) presents this as a maximum-severity, remotely exploitable, unauthenticated issue, and the scope change plus C:H/I:H is justified because a stolen Consul token yields the victim's authority. However, the raw 10.0 overstates practical ubiquity of the attack: exploitation is conditioned on the server being deployed in stateless mode AND on another legitimate client having supplied a valid token that lands in the shared state - the attacker does not fully control this timing, which in CVSS 4.0 terms is an Attack Requirement (AT:P). No EPSS score, POC, or KEV entry was provided, so there is no evidence of active or automated exploitation; the risk is currently theoretical-but-serious. Net: treat as a genuine high priority for anyone running consul-mcp-server in stateless mode with multiple clients, but the very low real-world deployment footprint of this new tooling tempers fleet-wide urgency. Note conflict to verify: PR:N describes the attacker needing no credentials, yet the attack materially depends on a victim client's token being present - defenders should read PR:N as 'attacker needs no auth' not 'no preconditions.'

An attacker connects as a client to a shared consul-mcp-server running in stateless mode alongside legitimate users. After a victim client authenticates with its Consul ACL token, the attacker issues its own MCP requests and the server reuses the victim's leaked token, letting the attacker read Consul KV/secrets and perform write operations under the victim's identity. No public POC is known, and the attack requires the attacker to reach the same multi-client stateless server while a victim token is resident in shared state.