CVE-2026-16328 Overview
CVE-2026-16328 is a Server-Side Request Forgery (SSRF) vulnerability in HashiCorp consul-mcp-server versions 0.1.0 through 0.1.3. The server fails to restrict how the Consul backend address is supplied. A connected client can override the server's configured Consul address by passing a request header. This allows a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint. The redirection can leak the Consul token configured on the server, exposing service mesh credentials. HashiCorp fixed the issue in consul-mcp-server0.1.4. The vulnerability maps to CWE-918: Server-Side Request Forgery.
Critical Impact
A network-accessible client can redirect Consul API calls to attacker infrastructure and exfiltrate the server's Consul token, granting unauthorized access to the Consul cluster.
Affected Products
- HashiCorp consul-mcp-server0.1.0
- HashiCorp consul-mcp-server versions 0.1.1 through 0.1.2
- HashiCorp consul-mcp-server0.1.3
Discovery Timeline
- 2026-07-29 - CVE-2026-16328 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-16328
Vulnerability Analysis
The consul-mcp-server implements a Model Context Protocol (MCP) server that brokers requests from clients to a HashiCorp Consul backend. The server reads its Consul address from configuration at startup and attaches a preconfigured Consul ACL token to outbound API calls. In vulnerable releases, the server also accepts a request header from clients that overrides the configured backend address. When the header is present, the server directs its Consul API traffic, along with the configured token, to the address the client specifies. An attacker who can connect to the MCP server can force it to authenticate to an endpoint the attacker controls. The scope-changed impact reflects that a compromise of the MCP server's identity extends to the Consul cluster it protects.
Root Cause
The root cause is missing input validation on a client-supplied header used to select the Consul backend address. The server treats the header as authoritative instead of restricting the backend to the operator-provided configuration. Because the outbound request carries the server-side Consul token, the token becomes attacker-observable once the request reaches an untrusted destination.
Attack Vector
Exploitation requires only network access to the MCP server. The attacker sends a normal MCP request that includes the override header pointing to a listener under attacker control. The server then issues its Consul API request, including the X-Consul-Token or equivalent authentication material, to the attacker endpoint. The attacker captures the token and reuses it against the legitimate Consul cluster. See the HashiCorp Security Advisory HCSEC-2026-24 for authoritative technical details.
Detection Methods for CVE-2026-16328
Indicators of Compromise
- Outbound connections from the consul-mcp-server host to Consul addresses that do not match the operator-configured backend.
- MCP request logs containing a Consul address override header supplied by a client.
- Consul audit logs showing use of the server's ACL token from unexpected source IPs or user agents.
- New or unknown listeners receiving HTTP requests carrying X-Consul-Token headers.
Detection Strategies
- Alert on any egress from the MCP server process to destinations outside an allowlist of approved Consul endpoints.
- Inspect MCP request payloads and HTTP headers for fields that specify a Consul address, and flag values not matching the configured backend.
- Correlate Consul token usage across source IPs to detect the same token appearing from unexpected origins.
Monitoring Recommendations
- Ingest MCP server access logs and Consul audit logs into a centralized data lake for cross-source correlation.
- Monitor DNS resolution requests from the MCP server host for unusual or newly registered domains.
- Track process-level network telemetry on the MCP server to baseline normal Consul API destinations.
How to Mitigate CVE-2026-16328
Immediate Actions Required
- Upgrade consul-mcp-server to version 0.1.4 or later on all hosts.
- Rotate the Consul ACL token configured on any MCP server that ran a vulnerable version and was exposed to untrusted clients.
- Review Consul audit logs for use of the affected token from unexpected sources and revoke sessions if suspicious activity is found.
- Restrict network access to the MCP server so only trusted clients can reach it.
Patch Information
HashiCorp released the fix in consul-mcp-server0.1.4. The patched version no longer honors the client-supplied header that overrides the Consul backend address. Refer to HashiCorp Security Advisory HCSEC-2026-24 for release notes and remediation guidance.
Workarounds
- Place the MCP server behind an authenticating proxy that strips client-supplied Consul address override headers before requests reach the server.
- Use host firewall rules or egress policies to restrict outbound connections from the MCP server to the intended Consul backend address only.
- Issue the MCP server a scoped Consul ACL token with the minimum privileges required, reducing impact if the token is exfiltrated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
