← Back

CVE-2026-16326

nvd nist
Published: Jul 29, 2026Modified: Jul 30, 2026Deferred

JSON object

Loading...
10.0
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Exploitability: 3.9 / Impact: 6.0
Source: security@hashicorp.com (Secondary)

Description

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

Related CWEs

CWE-488
Exposure of Data Element to Wrong Session
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

References (1)

Source: security@hashicorp.com

Timeline

No history available yet.