EUVD-2026-50466
GHSA-5h6c-295f-7pp3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed MCP server
-
DeliverySend request with Consul-address override header
-
ExploitServer issues Consul API call to attacker endpoint
-
ExecutionCapture leaked Consul token
-
PersistReplay token against real Consul API
-
ImpactAccess Consul secrets and services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker be a client able to reach the consul-mcp-server and send a request containing the Consul-backend-address override header, and that the server was started with a configured Consul token worth stealing; the attacker must also control (or observe traffic to) the redirected endpoint to capture the token. Limiting factors: the server must be network-reachable by the attacker (the description calls it a 'connected client', and the CVSS PR:N implies no authentication is enforced, though whether the deployment actually exposes the endpoint without auth or network controls determines real exposure), and only versions 0.1.0-0.1.3 are vulnerable - 0.1.4 ignores the client-supplied address. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N describes a network-reachable, low-complexity attack requiring no privileges or user interaction, with a scope change (the vulnerable server leaks a credential that grants access to a separate Consul system) and high confidentiality impact but no integrity or availability impact - consistent with credential-theft SSRF rather than direct code execution. No EPSS score, KEV entry, or POC was supplied, so despite the high base score real-world exploitation pressure is currently unquantified and appears theoretical/vendor-reported. One caveat to verify: the vector uses PR:N (unauthenticated) yet the description specifies a 'connected client', so real risk depends on whether the MCP endpoint is exposed without authentication or network restriction - if the server is only reachable by trusted local clients, practical exposure is far lower than the 8.6 suggests. |
| Exploit ScenarioDerived | An attacker who can send requests to an exposed consul-mcp-server includes a crafted header that points the Consul backend address at a server they control. The MCP server then issues its next Consul API call - carrying its configured Consul token - to the attacker's endpoint, which simply logs the inbound credential. The attacker replays the stolen token against the real Consul API to read configuration, secrets, or service data; no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the server's configured Consul backend address through an untrusted request header, redirecting the server's Consul API calls to an attacker-controlled endpoint and exfiltrating the privileged Consul token held by the server. The flaw carries a CVSS 8.6 (scope-changed, high confidentiality impact) and is fixed in 0.1.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: consul-mcp-server 0.1.4 - upgrade to 0.1.4 or later, which restricts the Consul backend address to the server's configured value and ignores client-supplied overrides; see HashiCorp advisory HCSEC-2026-24 at https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612. Where immediate upgrade is not possible, restrict network access to the MCP server so only trusted clients can reach it and place it behind authentication, strip or reject the header used to override the Consul address at a reverse proxy, and use egress filtering to allow the server to reach only the legitimate Consul address (side effect: egress allowlisting must be updated if the Consul endpoint changes). As a defensive measure, rotate the configured Consul token after patching in case it was already exposed, and scope that token to least privilege to limit the blast radius of any leak.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
consul-mcp-server is a Model Context Protocol (MCP) server that brokers requests from MCP clients (typically LLM agents/tools) to a HashiCorp Consul backend, authenticating to Consul with a server-side token. The root cause is CWE-918 (SSRF): the destination Consul address is trusted from a client-supplied request header rather than being pinned to the operator's configured value, so the server can be coerced into making outbound API calls to an arbitrary host. Because the server attaches its configured Consul token to those calls, redirecting the destination causes the secret token to be delivered to whatever endpoint the attacker names. The affected component is identified by CPE cpe:2.3:a:hashicorp:tooling:*, and HashiCorp tracks it in advisory HCSEC-2026-24.
Know when Tooling gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-reachable header injection needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); leaking the token to a separate Consul system is a scope change with high confidentiality but no integrity/availability impact.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
2DescriptionCVE.org
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially exfiltrating the Consul token configured on the server. This vulnerability, CVE-2026-16328, is fixed in consul-mcp-server 0.1.4.
Executive ViewAI
HashiCorp consul-mcp-server versions 0.1.0 through 0.1.3 contain a vulnerability allowing connected clients to intercept and redirect the server's Consul API communications, potentially stealing the privileged Consul authentication token that grants cluster-wide access. Any organization using these versions risks unauthorized access to their Consul infrastructure and exposure of sensitive configuration and secrets. Immediate patching to version 0.1.4 is critical to prevent token compromise and unauthorized cluster manipulation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on beha
Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication
Cross-namespace authorization bypass in HashiCorp consul-k8s 0.42.0 and later can let an attacker with an existing low-p
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes te
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains ano
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to re
Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to impr
Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote att
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended
Exploit-DB