What is the CVSS score of CVE-2026-16326?

CVE-2026-16326 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of consul-mcp-server are affected by CVE-2026-16326?

HashiCorp consul-mcp-server versions 0.1.0-0.1.3 leak Consul authentication tokens across client sessions when run in stateless mode, allowing attackers to execute infrastructure commands with victim…. A patch is available.

How to fix or mitigate CVE-2026-16326?

Within 24 hours, identify all consul-mcp-server deployments in versions 0.1.0-0.1.3 running in stateless mode and assess which Consul permissions each instance holds. Within 7 days, upgrade all affected deployments to consul-mcp-server 0.1.4 or later, prioritizing instances with elevated Consul permissions or access to production infrastructure. Within 30 days, complete all upgrades, audit Consul logs for evidence of cross-session token misuse during the vulnerability exposure window, and rotate Consul tokens issued to affected deployments.

consul-mcp-server CVE-2026-16326

EUVD-2026-50469 CRITICAL

Exposure of Data Element to Wrong Session (CWE-488)

2026-07-29 HashiCorp

GHSA-6c5r-pj95-xvqv

Information Disclosure Hashicorp Tooling

10.0

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

8.9 HIGH

Attacker needs no auth (PR:N) and network reach (AV:N), but success depends on a victim token being resident in stateless shared state (AC:H); leaked Consul token crosses into Consul (S:C, C:H/I:H, A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 29, 2026 - 20:02 EUVD

Analysis Generated

Jul 29, 2026 - 19:24 vuln.today

CVE Published

Jul 29, 2026 - 18:40 cve.org

CRITICAL 10.0

DescriptionCVE.org

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

AnalysisAI

Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication token to bleed into requests issued by other clients when the server runs in stateless mode, effectively enabling an attacker to act against Consul with a victim's credentials. HashiCorp rated this CVSS 10.0 (scope-changed) because the borrowed token grants the attacker the victim's full Consul read/write authority across a trust boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is consul-mcp-server 0.1.4.

Technical ContextAI

consul-mcp-server is HashiCorp's Model Context Protocol (MCP) server that exposes HashiCorp Consul operations to LLM/agent clients. In 'stateless' mode the server does not maintain per-connection session objects, and the flaw is that authentication state - specifically the Consul ACL token supplied by a client - was not properly isolated to the originating session. This is CWE-488 (Exposure of Data Element to Wrong Session): a token placed in shared or improperly-scoped state is subsequently read and used to authorize a different client's request. Because the leaked element is a Consul ACL token, the impact propagates into Consul itself (the CVSS scope change, S:C), where the token's granted policies determine what the attacker can read or modify.

RemediationAI

Vendor-released patch: upgrade to consul-mcp-server 0.1.4, which properly isolates per-session authentication state; this is the primary and complete fix (see HCSEC-2026-24, https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612). If you cannot upgrade immediately, stop running the server in stateless mode and switch to a stateful/session-isolated deployment so tokens are bound to their originating connection - the trade-off is higher per-connection resource use and loss of the horizontal-scaling benefit stateless mode provides. As an additional compensating control, run a dedicated server instance per client or per trust boundary so no shared state is co-mingled, and scope each Consul ACL token to least privilege so that any leaked token grants minimal authority; the side effect is more operational overhead and more tokens to manage. Rotate any Consul ACL tokens that may have transited an affected stateless deployment.