EUVD-2026-50466
GHSA-5h6c-295f-7pp3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-reachable header injection needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); leaking the token to a separate Consul system is a scope change with high confidentiality but no integrity/availability impact.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially exfiltrating the Consul token configured on the server. This vulnerability, CVE-2026-16328, is fixed in consul-mcp-server 0.1.4.
AnalysisAI
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the server's configured Consul backend address through an untrusted request header, redirecting the server's Consul API calls to an attacker-controlled endpoint and exfiltrating the privileged Consul token held by the server. The flaw carries a CVSS 8.6 (scope-changed, high confidentiality impact) and is fixed in 0.1.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker be a client able to reach the consul-mcp-server and send a request containing the Consul-backend-address override header, and that the server was started with a configured Consul token worth stealing; the attacker must also control (or observe traffic to) the redirected endpoint to capture the token. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N describes a network-reachable, low-complexity attack requiring no privileges or user interaction, with a scope change (the vulnerable server leaks a credential that grants access to a separate Consul system) and high confidentiality impact but no integrity or availability impact - consistent with credential-theft SSRF rather than direct code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can send requests to an exposed consul-mcp-server includes a crafted header that points the Consul backend address at a server they control. The MCP server then issues its next Consul API call - carrying its configured Consul token - to the attacker's endpoint, which simply logs the inbound credential. … |
| Remediation | Vendor-released patch: consul-mcp-server 0.1.4 - upgrade to 0.1.4 or later, which restricts the Consul backend address to the server's configured value and ignores client-supplied overrides; see HashiCorp advisory HCSEC-2026-24 at https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all instances of consul-mcp-server 0.1.0 through 0.1.3 in your infrastructure and create a patching plan with prioritization by environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on beha
Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains ano
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to re
Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote att
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today