# CVE-2026-16326: HashiCorp consul-mcp-server session state leakage in stateless mode

Source: https://junglewise.ai/threats/cve-2026-16326-hashicorp-consul-mcp-server-session-state-leakage-in-stateless  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-16326 · Severity: critical · CVSS 10 · Published 2026-07-29

HashiCorp consul-mcp-server is a tool that allows AI agents to interact with Consul infrastructure. A security flaw in how the server handles user sessions means that one user's secret authentication token could be accidentally reused for a different user's request. This could allow an unauthorized person to perform actions or access data in the Consul cluster using someone else's identity.

Vendors: [HashiCorp](https://junglewise.ai/threats/vendors/hashicorp).

## Quick answers

**Is CVE-2026-16326 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16326 being exploited in the wild.

**How severe is CVE-2026-16326?** Critical severity, with a CVSS score of 10, published 29 July 2026.

**Which products and versions are affected?** HashiCorp Consul-Mcp-Server 0.1.0 to 0.1.3.

**Is there a fix for CVE-2026-16326?** A patch was published on 2026-07-29: Fixed in version 0.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16326 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16326?** Check whether you run HashiCorp Consul-Mcp-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a session isolation failure (CWE-488) within the consul-mcp-server when configured in stateless transport mode. The server maintains a per-session cache of authenticated Consul clients but fails to correctly segregate these sessions in stateless mode. As a result, an authenticated Consul client object (and its associated token) belonging to one session may be reused for subsequent requests from a different client. An attacker can exploit this to execute tool calls or Consul API requests using the credentials of another active user. The issue is resolved in version 0.1.4; stateful mode deployments are not affected.

## Affected products

- HashiCorp consul-mcp-server 0.1.0 to 0.1.3

## Timeline

- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched: Fixed in version 0.1.4

## References

- [https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612](https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612)

## Related threats

- [HashiCorp consul-mcp-server SSRF and token exfiltration](https://junglewise.ai/threats/cve-2026-16328-hashicorp-consul-mcp-server-ssrf-and-token-exfiltration)