EUVD-2026-50469
GHSA-6c5r-pj95-xvqv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Attacker needs no auth (PR:N) and network reach (AV:N), but success depends on a victim token being resident in stateless shared state (AC:H); leaked Consul token crosses into Consul (S:C, C:H/I:H, A:L).
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.
AnalysisAI
Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication token to bleed into requests issued by other clients when the server runs in stateless mode, effectively enabling an attacker to act against Consul with a victim's credentials. HashiCorp rated this CVSS 10.0 (scope-changed) because the borrowed token grants the attacker the victim's full Consul read/write authority across a trust boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the consul-mcp-server (versions 0.1.0-0.1.3) to be deployed in stateless mode serving multiple clients, AND at least one other client to have already supplied a valid Consul authentication token that lands in the improperly-isolated shared state; the attacker then reuses that token via ordinary MCP requests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L = 10.0) presents this as a maximum-severity, remotely exploitable, unauthenticated issue, and the scope change plus C:H/I:H is justified because a stolen Consul token yields the victim's authority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker connects as a client to a shared consul-mcp-server running in stateless mode alongside legitimate users. After a victim client authenticates with its Consul ACL token, the attacker issues its own MCP requests and the server reuses the victim's leaked token, letting the attacker read Consul KV/secrets and perform write operations under the victim's identity. … |
| Remediation | Vendor-released patch: upgrade to consul-mcp-server 0.1.4, which properly isolates per-session authentication state; this is the primary and complete fix (see HCSEC-2026-24, https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all consul-mcp-server deployments in versions 0.1.0-0.1.3 running in stateless mode and assess which Consul permissions each instance holds. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on beha
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains ano
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to re
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the se
Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote att
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended
Same weakness CWE-488 – Exposure of Data Element to Wrong Session
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today