CRITICAL 10.0 NVD

CVE-2026-16326

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication to

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

References

https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp

Published: 2026-07-29 · Source: NVD · Feed updated: 2026-08-04

This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-07-29 via NVD.

Risk Timeline

CVE Disclosed2026-07-29 · 5 days ago

Remediation Resources

Official Advisory

discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacti

vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.