CVE-2026-16326 Overview
CVE-2026-16326 is a session state isolation flaw in HashiCorp consul-mcp-server versions 0.1.0 through 0.1.3. When operating in stateless mode, the server fails to isolate session state between clients. One client's Consul authentication token can be reused for requests originating from other clients. This allows a remote, unauthenticated attacker to hijack another user's session and act with that user's Consul privileges. HashiCorp addressed the issue in consul-mcp-server0.1.4. The weakness is classified under [CWE-488: Exposure of Data Element to Wrong Session].
Critical Impact
Cross-client leakage of Consul authentication tokens enables unauthenticated attackers to impersonate legitimate users and access Consul APIs with their permissions.
Affected Products
- HashiCorp consul-mcp-server0.1.0
- HashiCorp consul-mcp-server versions 0.1.1 through 0.1.2
- HashiCorp consul-mcp-server0.1.3
Discovery Timeline
- 2026-07-29 - CVE-2026-16326 published to the National Vulnerability Database (NVD)
- 2026-07-30 - CVE-2026-16326 last updated in NVD
Technical Details for CVE-2026-16326
Vulnerability Analysis
The consul-mcp-server implements a Model Context Protocol (MCP) interface that brokers requests to HashiCorp Consul on behalf of MCP clients. In stateless deployment mode, the server does not bind an authenticated Consul token to the specific client session that supplied it. As a result, tokens submitted by one client persist in a shared context that other concurrent clients can consume. Any subsequent request that reaches the shared handler can execute against Consul using another client's credentials. The confidentiality and integrity impact reaches into the Consul control plane, where tokens may govern service registration, key/value data, and ACL policies.
Root Cause
The root cause is [CWE-488] Exposure of Data Element to Wrong Session. The stateless handling path stores or resolves the Consul token in a scope that is not partitioned per client session. Session identifiers are not used as the isolation boundary for token retrieval, so token lookup is effectively global to the process.
Attack Vector
An attacker connects to a vulnerable consul-mcp-server instance over the network at the same time a legitimate client is active. The attacker issues MCP requests that trigger the server's Consul call path. The server resolves an authentication token from the shared stateless context and forwards the request to Consul under the victim's identity. No prior credentials or user interaction are required for the attacker.
No public proof-of-concept code is available. See the HashiCorp Security Advisory for vendor-supplied technical detail.
Detection Methods for CVE-2026-16326
Indicators of Compromise
- Consul audit log entries showing API calls attributed to a token but originating from unexpected source IPs or MCP client identifiers.
- Concurrent MCP sessions on consul-mcp-server where the same Consul token appears associated with distinct client fingerprints.
- Consul ACL activity outside a user's normal working hours or from a session that predates the user's login.
Detection Strategies
- Correlate consul-mcp-server request logs with Consul server audit logs and alert when a single token is used across multiple MCP client identifiers within a short window.
- Inventory running consul-mcp-server binaries and flag any instance reporting a version between 0.1.0 and 0.1.3.
- Monitor Consul ACL token usage patterns and baseline the set of MCP clients each token is expected to originate from.
Monitoring Recommendations
- Enable Consul audit logging with client metadata and forward events to a centralized analytics platform for cross-source correlation.
- Track process and container inventory for the consul-mcp-server component and alert on outdated versions.
- Review network flows to MCP server listeners for unexpected external clients, particularly on shared or multi-tenant hosts.
How to Mitigate CVE-2026-16326
Immediate Actions Required
- Upgrade every consul-mcp-server instance to version 0.1.4 or later.
- Rotate all Consul ACL tokens that were used through a vulnerable consul-mcp-server deployment.
- Restrict network access to consul-mcp-server listeners so only trusted MCP clients can reach the service while upgrades roll out.
Patch Information
HashiCorp fixed CVE-2026-16326 in consul-mcp-server0.1.4. Refer to the HashiCorp Security Advisory HCSEC-2026-24 for release notes and download locations. Verify the upgraded binary version after deployment.
Workarounds
- If upgrading is not immediately possible, run consul-mcp-server in a single-tenant configuration where only one client connects to each instance.
- Place the MCP server behind an authenticating reverse proxy that enforces per-client isolation until the patched version is deployed.
- Reduce the privilege scope of Consul tokens issued to MCP clients to limit blast radius if a token is reused across sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
