Quick answers
- Is CVE-2026-16328 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16328 being exploited in the wild.
- How severe is CVE-2026-16328?
- High severity, with a CVSS score of 8.6, published 29 July 2026.
- Which products and versions are affected?
- HashiCorp consul-mcp-server 0.1.0 - 0.1.3.
- Is there a fix for CVE-2026-16328?
- A patch was published on 2026-07-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-16328 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-16328?
- Check whether you run HashiCorp Consul-Mcp-Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in consul-mcp-server versions 0.1.0 through 0.1.3. The server fails to validate or restrict the Consul backend address when it is supplied via a client-provided request header. A remote, unauthenticated attacker can exploit this to override the configured Consul address, forcing the server to send API requests—including the configured Consul authentication token—to an attacker-controlled endpoint. This issue is fixed in version 0.1.4.
Affected products
- HashiCorp consul-mcp-server 0.1.0 - 0.1.3
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched