# CVE-2026-16328: HashiCorp consul-mcp-server SSRF and token exfiltration

Source: https://junglewise.ai/threats/cve-2026-16328-hashicorp-consul-mcp-server-ssrf-and-token-exfiltration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-16328 · Severity: high · CVSS 8.6 · Published 2026-07-29

HashiCorp consul-mcp-server is a tool that allows AI agents to interact with Consul clusters. A vulnerability in this server allows a connected user to redirect the server's internal traffic to a malicious destination. This could result in the theft of sensitive Consul authentication tokens, potentially giving an attacker unauthorized access to the broader Consul environment.

Vendors: [HashiCorp](https://junglewise.ai/threats/vendors/hashicorp).

## Quick answers

**Is CVE-2026-16328 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16328 being exploited in the wild.

**How severe is CVE-2026-16328?** High severity, with a CVSS score of 8.6, published 29 July 2026.

**Which products and versions are affected?** HashiCorp consul-mcp-server 0.1.0 - 0.1.3.

**Is there a fix for CVE-2026-16328?** A patch was published on 2026-07-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16328 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16328?** Check whether you run HashiCorp Consul-Mcp-Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in consul-mcp-server versions 0.1.0 through 0.1.3. The server fails to validate or restrict the Consul backend address when it is supplied via a client-provided request header. A remote, unauthenticated attacker can exploit this to override the configured Consul address, forcing the server to send API requests—including the configured Consul authentication token—to an attacker-controlled endpoint. This issue is fixed in version 0.1.4.

## Affected products

- HashiCorp consul-mcp-server 0.1.0 - 0.1.3

## Timeline

- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched

## References

- [https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612](https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612)

## Related threats

- [HashiCorp consul-mcp-server session state leakage in stateless mode](https://junglewise.ai/threats/cve-2026-16326-hashicorp-consul-mcp-server-session-state-leakage-in-stateless)