CVE-2026-16326 - Vulnerability Details - OpenCVE

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00299.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Hashicorp	Tooling

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Hashicorp	Tooling

References

Link	Providers
https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612

History

Thu, 30 Jul 2026 22:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 29 Jul 2026 20:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Hashicorp Hashicorp tooling
Vendors & Products		Hashicorp Hashicorp tooling

Wed, 29 Jul 2026 19:00:00 +0000

Type	Values Removed	Values Added
Description		In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.
Title		consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
Weaknesses		CWE-488
References		https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: HashiCorp

Published: 2026-07-29T18:40:08.796Z

Updated: 2026-07-29T19:10:11.027Z

Reserved: 2026-07-20T17:50:16.465Z

Link: CVE-2026-16326

Vulnrichment

Updated: 2026-07-29T19:10:07.395Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-29T20:30:03Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16326", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "state": "PUBLISHED", "assignerShortName": "HashiCorp", "dateReserved": "2026-07-20T17:50:16.465Z", "datePublished": "2026-07-29T18:40:08.796Z", "dateUpdated": "2026-07-29T19:10:11.027Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Tooling", "repo": "https://github.com/hashicorp/consul-mcp-server", "vendor": "HashiCorp", "versions": [{"lessThan": "0.1.4", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "value": "This issue was reported by an internal HashiCorp team."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.</p><br/>"}], "value": "In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4."}], "impacts": [{"capecId": "CAPEC-60", "descriptions": [{"lang": "en", "value": "CAPEC-60: Reusing Session IDs (Session Replay)"}]}], "metrics": [{"cvssV3_1": {"baseScore": 10, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-488", "description": "CWE-488: Exposure of Data Element to Wrong Session", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2026-07-29T18:40:08.796Z"}, "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612"}], "source": {"advisory": "HCSEC-2026-24", "discovery": "INTERNAL"}, "title": "consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T19:10:01.220224Z", "id": "CVE-2026-16326", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T19:10:11.027Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16326", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T19:10:01.220224Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T19:10:07.395Z"}}], "cna": {"title": "consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode", "source": {"advisory": "HCSEC-2026-24", "discovery": "INTERNAL"}, "credits": [{"lang": "en", "value": "This issue was reported by an internal HashiCorp team."}], "impacts": [{"capecId": "CAPEC-60", "descriptions": [{"lang": "en", "value": "CAPEC-60: Reusing Session IDs (Session Replay)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 10, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/hashicorp/consul-mcp-server", "vendor": "HashiCorp", "product": "Tooling", "versions": [{"status": "affected", "version": "0.1.0", "lessThan": "0.1.4", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612"}], "descriptions": [{"lang": "en", "value": "In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.", "supportingMedia": [{"type": "text/html", "value": "<p>In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.</p><br/>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-488", "description": "CWE-488: Exposure of Data Element to Wrong Session"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2026-07-29T18:40:08.796Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16326", "state": "PUBLISHED", "dateUpdated": "2026-07-29T19:10:11.027Z", "dateReserved": "2026-07-20T17:50:16.465Z", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "datePublished": "2026-07-29T18:40:08.796Z", "assignerShortName": "HashiCorp"}, "dataVersion": "5.2"}