Bulletin ID: HCSEC-2026-24
Affected Products / Versions: consul-mcp-server 0.1.0 up to 0.1.3; fixed in 0.1.4.
Publication Date: July 29, 2026
Summary
consul-mcp-server versions 0.1.0 up to 0.1.3 are affected by two vulnerabilities. First, the server did not restrict client-supplied overrides of the Consul backend address, which may allow a connected client to redirect Consul API traffic to an attacker-controlled endpoint and potentially exfiltrate the server’s configured Consul token (CVE-2026-16328). Second, the server did not properly isolate session state in stateless mode, which may allow one client’s Consul authentication token to be used for requests from a different client (CVE-2026-16326). Both vulnerabilities are fixed in consul-mcp-server 0.1.4.
Background
The consul-mcp-server is an MCP (Model Context Protocol) server that provides AI agents and tooling with access to a Consul cluster. It connects to Consul using a backend address and token configured in the server’s environment, and maintains a per-session cache of authenticated Consul clients. The server supported per-request overrides of the Consul address via client-supplied HTTP headers, and can operate in either stateful or stateless transport mode.
Details
CVE-2026-16328: Server-side request forgery via client-supplied Consul address
The per-request address override feature did not validate or restrict the destination supplied by the client. This may allow a connected client to cause the server to direct its Consul API traffic, including any configured credentials, to an unintended destination, potentially leading to credential exfiltration or server-side request forgery against targets reachable from the server. The issue affects deployments where the MCP server is reachable by clients that are not fully trusted. Deployments with no Consul token configured in the environment are not exposed to credential exfiltration.
CVE-2026-16326: Cross-tenant credential reuse in stateless mode
When operating in stateless mode, the server did not correctly isolate per-client session state, which could cause an authenticated Consul client belonging to one session to be reused for requests from a different client. This may lead to tool calls being executed using another client’s Consul token. The issue affects deployments running in stateless mode where more than one client can connect. Stateful mode deployments are not affected.
Remediation
Customers should evaluate the risk associated with these issues and consider upgrading to consul-mcp-server 0.1.4. Operators who cannot upgrade immediately should restrict network access to the MCP server to trusted clients.
Acknowledgement
CVE-2026-16328 was identified by He Wei（ギカク）. CVE-2026-16326 was reported by an internal HashiCorp team.
We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.