AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

HashiCorpCVE-2026-16326

In consul-mcp-server

HashiCorp

CVE-2026-16326 · Published Jul 29, 2026 · updated Jul 30, 2026

Critical10.0
Fix: upgrade to 0.1.4 or later
HashiCorp advisory

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

Affected versions

PackageAffectedFixed in
Tooling
Product
>= 0.1.0, < 0.1.40.1.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-488

More HashiCorp advisories

All HashiCorp
Medium 5.3Aug 7HashiCorp Consul: denial of serviceCVE-2026-19113fixed in 2.0.3 +1Medium 4.2Aug 7Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are...CVE-2026-15970fixed in 2.0.3 +1High 8.6Jul 29HashiCorp Tooling: server-side request forgeryCVE-2026-16328fixed in 0.1.4Critical 10.0Jul 28The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant...CVE-2026-16498fixed in 1.1.0High 8.6Jul 28HashiCorp Tooling: server-side request forgeryCVE-2026-14869fixed in 1.1.0High 8.9Jul 28HashiCorp Tooling: session fixationCVE-2026-16496fixed in 1.1.0