CVE-2026-16326

CriticalCVSS 10.0

Published: 29/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

A vulnerability in consul-mcp-server versions 0.1.0 through 0.1.3 causes a Consul authentication token from one client to be reused for subsequent requests from other clients in stateless mode. Lack of session state isolation allows unauthorized access to Consul resources.

Risk Assessment

An attacker can impersonate another client and gain unauthorized access to Consul server management, potentially leading to compromise of infrastructure configuration integrity.

Recommendation

Upgrade consul-mcp-server to version 0.1.4 or later.

Original NVD description (English source)

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.