What is the CVSS score of CVE-2026-16328?

CVE-2026-16328 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of consul-mcp-server are affected by CVE-2026-16328?

HashiCorp consul-mcp-server versions 0.1.0 through 0.1.3 contain a vulnerability allowing connected clients to intercept and redirect the server's Consul API communications, potentially stealing the…. A patch is available.

How to fix or mitigate CVE-2026-16328?

Within 24 hours: identify all instances of consul-mcp-server 0.1.0 through 0.1.3 in your infrastructure and create a patching plan with prioritization by environment. Within 7 days: upgrade all affected consul-mcp-server instances to version 0.1.4 or later, starting with production deployments. Within 30 days: verify all upgrades are complete, review Consul access logs for any suspicious API calls or token usage during the vulnerability exposure period, and confirm no unauthorized modifications were made to Consul configurations.

consul-mcp-server CVE-2026-16328

EUVD-2026-50466 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-29 HashiCorp

GHSA-5h6c-295f-7pp3

SSRF Hashicorp Tooling

8.6

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Network-reachable header injection needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); leaking the token to a separate Consul system is a scope change with high confidentiality but no integrity/availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 29, 2026 - 20:02 EUVD

Analysis Generated

Jul 29, 2026 - 19:24 vuln.today

CVE Published

Jul 29, 2026 - 18:32 cve.org

HIGH 8.6

DescriptionCVE.org

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially exfiltrating the Consul token configured on the server. This vulnerability, CVE-2026-16328, is fixed in consul-mcp-server 0.1.4.

AnalysisAI

Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the server's configured Consul backend address through an untrusted request header, redirecting the server's Consul API calls to an attacker-controlled endpoint and exfiltrating the privileged Consul token held by the server. The flaw carries a CVSS 8.6 (scope-changed, high confidentiality impact) and is fixed in 0.1.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

consul-mcp-server is a Model Context Protocol (MCP) server that brokers requests from MCP clients (typically LLM agents/tools) to a HashiCorp Consul backend, authenticating to Consul with a server-side token. The root cause is CWE-918 (SSRF): the destination Consul address is trusted from a client-supplied request header rather than being pinned to the operator's configured value, so the server can be coerced into making outbound API calls to an arbitrary host. Because the server attaches its configured Consul token to those calls, redirecting the destination causes the secret token to be delivered to whatever endpoint the attacker names. The affected component is identified by CPE cpe:2.3:a:hashicorp:tooling:*, and HashiCorp tracks it in advisory HCSEC-2026-24.

RemediationAI

Vendor-released patch: consul-mcp-server 0.1.4 - upgrade to 0.1.4 or later, which restricts the Consul backend address to the server's configured value and ignores client-supplied overrides; see HashiCorp advisory HCSEC-2026-24 at https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612. Where immediate upgrade is not possible, restrict network access to the MCP server so only trusted clients can reach it and place it behind authentication, strip or reject the header used to override the Consul address at a reverse proxy, and use egress filtering to allow the server to reach only the legitimate Consul address (side effect: egress allowlisting must be updated if the Consul endpoint changes). As a defensive measure, rotate the configured Consul token after patching in case it was already exposed, and scope that token to least privilege to limit the blast radius of any leak.