Skip to content
eastbaycyber

CVE-2026-16326: HashiCorp consul-mcp-server Token Isolation Flaw

CVE explainers 10 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-07-29
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - consul-mcp-server 0.1.0 through 0.1.3 can reuse one client’s Consul token for another client in stateless mode. - Upgrade to 0.1.4 and review any shared or multi-client deployments immediately. - No confirmed in-the-wild exploitation is public yet, but the vendor and NVD rate this issue critical.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-16326
CVSS 10.0 (Critical)
Attack vector Not explicitly provided in the source data; exposure is tied to requests handled by consul-mcp-server in stateless mode
Privileges required Unknown from published source text; defenders should assume reachable service interaction may be sufficient in affected workflows
Patch available Yes, fixed in 0.1.4

CVE-2026-16326 is a critical vulnerability in HashiCorp consul-mcp-server. According to the NVD description and HashiCorp’s bulletin metadata, affected versions are 0.1.0 through 0.1.3, and the issue is fixed in 0.1.4. The flaw is not described as a classic memory corruption bug or denial-of-service condition. Instead, it breaks identity and authorization boundaries by allowing one client’s Consul authentication token to be reused for later requests from another client.

For defenders, that distinction matters. A token confusion issue in a broker, gateway, or shared service can be more dangerous operationally than a crash bug because it may produce valid-looking requests under the wrong identity. That creates risk for unauthorized reads, writes, service discovery actions, or ACL-protected operations inside Consul, especially where multiple users, agents, or automations share the same consul-mcp-server instance.

What Is This Vulnerability?

The root cause is improper isolation of session state in stateless mode. In a correctly designed stateless flow, one client request should not contaminate the authentication context of another request. The published description indicates that in affected versions of consul-mcp-server, this isolation failed. As a result, authentication material associated with one client could persist or be incorrectly applied to subsequent requests from a different client.

In practical terms, this is a cross-client token reuse problem. Client A sends a request carrying or causing the service to use a particular Consul token. Later, Client B sends a separate request, but the server may process that request using Client A’s token. If Client A’s token has broader ACL privileges than Client B should have, Client B could gain unauthorized access. Conversely, logs or audit trails may record actions in ways that obscure the true origin, complicating incident response and forensic attribution.

Technical Notes

The public advisory text does not provide code-level patch detail or a full exploit chain. What is known is sufficient for defenders to classify this as a session/authentication context isolation failure in an affected shared service path. In the absence of source-level remediation notes, defenders should assume any deployment pattern that multiplexes requests from multiple clients through a single stateless-mode instance is higher risk than isolated single-client usage.

A simplified conceptual anti-pattern for this class of issue looks like this:

// Conceptual example only, not vendor code
var currentToken string

func handleRequest(req Request) Response {
    if req.Token != "" {
        currentToken = req.Token
    }

    // Wrong: subsequent requests can inherit token state
    return consulCall(currentToken, req.Operation)
}

A safer design pattern is per-request isolation, with no shared mutable auth context between clients:

// Conceptual example only, not vendor code
func handleRequest(req Request) Response {
    token := req.Token
    return consulCall(token, req.Operation)
}
AnalystImpact · assess the risk

Who Is Affected?

The affected product is HashiCorp consul-mcp-server. The vendor-confirmed affected range is versions 0.1.0 up to 0.1.3, and the fixed version is 0.1.4. Those version boundaries are explicitly stated in the NVD description and the HashiCorp security bulletin metadata.

Organizations should pay particular attention if they run consul-mcp-server in stateless mode and expose it to multiple clients, users, agents, or automation contexts. The wording of the advisory ties the bug specifically to stateless mode behavior. If your deployment does not use this product, or uses 0.1.4 or later, this specific CVE should not apply. If you run an affected version but are unsure whether stateless mode is enabled or whether requests from different clients share the same process, assume risk until configuration and runtime behavior are verified.

This vulnerability is especially relevant in environments where Consul ACL tokens carry meaningful privilege differences. For example, one client may have read-only access while another has broader service, KV, or administrative capabilities. In that scenario, token crossover is not just an authentication bug; it becomes an authorization bypass and possible lateral movement enabler inside the Consul control plane.

If you are an MSSP, platform team, or internal developer platform operator using a shared consul-mcp-server instance for multiple tenants or teams, treat this as a priority issue. The blast radius depends on the most privileged token that could be misapplied, not on the least privileged client that triggers the bug.

CVSS Score Breakdown

The NVD data available for this task reports a CVSS score of 10.0, which is the maximum possible severity. However, the full CVSS vector string was not provided in the source material used here. Because of that, it would be inaccurate to invent precise metric values such as attack complexity, confidentiality impact, or privileges required beyond what is explicitly supported by the published description.

That said, the maximum score strongly suggests the vulnerability is considered severe across multiple impact dimensions. The likely reason is straightforward: if one client can cause or benefit from the reuse of another client’s Consul authentication token, the consequences can include unauthorized access to sensitive configuration data, service discovery metadata, or ACL-protected operations. Depending on the privileges of the leaked or reused token, this could affect confidentiality, integrity, and potentially availability.

Defenders should be cautious not to overfit on the missing vector details. The absence of a visible vector string does not reduce operational urgency. When a vendor and NVD attach a 10.0 score to an auth-context isolation bug in shared infrastructure, the practical takeaway is immediate validation, patching, and token hygiene. Until more granular scoring data is published, assume the impact is environment-dependent but potentially severe wherever high-privilege Consul tokens transit the service.

Exploitation Status

At the time of writing, there is no confirmed public evidence of active exploitation in the wild in the sources reviewed for this article. The CVE is not currently listed in CISA’s Known Exploited Vulnerabilities catalog, which means CISA is not publicly tracking it as known exploited at this time.

There is also no verified public proof-of-concept (PoC) identified in the materials provided for this task. That does not mean exploitation is difficult or impossible. It means there is no public, validated PoC reference available in the cited primary sources at this time. For defenders, the right posture is not “wait for exploitation,” but “patch before this class of flaw becomes operationalized.”

This is the kind of issue that can be highly environment-specific. A public PoC may lag because reproducing the bug likely requires a realistic multi-client setup and request sequencing that demonstrates cross-client token reuse. Even without a public PoC, affected shared deployments should be treated as high risk because the impact mechanism is already clear from the vendor and NVD descriptions.

ResponderRunbook · act now

How to Detect It

Detection is challenging because the vulnerable behavior may manifest as valid requests under the wrong Consul token, not obviously malformed traffic. Start by reviewing application, proxy, and Consul audit logs for cases where a client or source identity performs actions inconsistent with its expected privileges. Focus on time-adjacent requests from different clients that unexpectedly appear under the same Consul token, ACL identity, or authorization context.

If you operate multi-tenant or shared automation workflows, compare the client identity observed at the ingress layer with the Consul token or ACL identity observed downstream. Any mismatch is worth investigating. Also review for sudden privilege shifts, such as a low-privilege workflow successfully performing reads or writes it should not be able to execute. Because vendor guidance does not publish a canonical log signature for this flaw, defenders must rely on correlation across layers rather than a single IOC.

Technical Notes

A practical detection approach is to correlate frontend client identity with downstream Consul token usage. Example pseudocode workflow:

  1. Capture source client identifier from reverse proxy or app logs.
  2. Capture Consul ACL token accessor or request identity from Consul audit logs, if enabled.
  3. Flag cases where two distinct client identities map to the same token in close succession.

Example grep workflow for suspicious reuse in normalized logs:

grep -E 'client_id=|consul_token_accessor=' /var/log/consul-mcp-server/*.log | 
awk '
/client_id=/ {client=$0}
/consul_token_accessor=/ {print client " || " $0}
' | sort

Example Splunk-style query to hunt for one token used across multiple clients:

index=app_logs ("consul_token_accessor=" AND "client_id=")
| rex "client_id=(?<client_id>[^
]+)"
| rex "consul_token_accessor=(?<token_accessor>[^
]+)"
| stats dc(client_id) as unique_clients values(client_id) as clients by token_accessor
| where unique_clients > 1

Example Sigma-like logic to adapt for SIEM translation:

title: Possible Cross-Client Consul Token Reuse
logsource:
  product: application
detection:
  selection:
    message|contains:
      - "client_id="
      - "consul_token_accessor="
  condition: selection
fields:
  - client_id
  - consul_token_accessor
level: high

Network-side visibility may be limited if traffic is encrypted, but if you have HTTP metadata at a reverse proxy, look for multiple authenticated client sessions funneled through a single consul-mcp-server instance followed by authorization anomalies in Consul.

Mitigation and Patching

The vendor-stated fix is to upgrade HashiCorp consul-mcp-server to version 0.1.4. If you are running 0.1.0 through 0.1.3, that is the primary remediation. Because the flaw concerns token reuse across clients, patching should be paired with credential hygiene. If there is any chance sensitive Consul tokens were exposed or misapplied, rotate them. This is especially important for tokens with write privileges, service registration rights, KV access, or administrative ACL capabilities.

You should also review whether the deployment truly needs the affected operating mode and whether shared instances handle requests from unrelated clients. If immediate patching is not possible, reduce exposure by isolating clients, segregating instances, limiting token scope, and minimizing token lifetime. These are workarounds, not fixes. The only vendor-confirmed remediation in the available sources is version 0.1.4.

Where defenders lack complete configuration certainty, the safe assumption is that any affected version in a shared stateless-mode deployment may permit token confusion. That warrants both patching and a post-upgrade validation step: verify that requests from separate clients no longer share authorization context and that logs reflect the expected client-to-token mapping.

Technical Notes

If you installed via Go tooling, a direct upgrade pattern may look like this:

go install github.com/hashicorp/consul-mcp-server@v0.1.4

If you deploy from source or CI/CD, pin the fixed release explicitly:

git fetch --tags
git checkout v0.1.4
go build ./...

If you package the binary into a container, rebuild from the fixed version and redeploy:

docker build --build-arg VERSION=v0.1.4 -t consul-mcp-server:0.1.4 .
docker stop consul-mcp-server
docker rm consul-mcp-server
docker run -d --name consul-mcp-server consul-mcp-server:0.1.4

Operational workarounds if upgrade must be delayed:

# Example defensive actions, adapt to your environment
# 1) Remove shared exposure behind a load balancer
# 2) Run one instance per tenant or automation context
# 3) Rotate Consul ACL tokens after patching
consul acl token list
consul acl token delete -id <old-token-accessor>
consul acl token create -description "rotated after CVE-2026-16326"

Validate after remediation by sending test requests from separate clients with distinct tokens and confirming the server never reuses the wrong credential.

References

The primary public sources for this CVE are the NVD record, the HashiCorp security bulletin, and the CISA KEV catalog status check. These are the most authoritative references available for the affected versions, fixed version, and current exploitation status included in this article.

Because some details remain unpublished or were not exposed in the available source outputs, defenders should continue monitoring the vendor advisory and NVD entry for updates such as a CVSS vector string, additional remediation notes, or newly disclosed detection guidance. In the meantime, the fixed version and the core impact are already clear enough to justify immediate action.

For further information on related topics, you can check out our articles on what is a rootkit and why SMBs are abandoning traditional SIEMs.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-07-29

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.