In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication to…

CVE-2026-16326 affects consul-mcp-server versions 0.1.0 through 0.1.3, where session state was not properly isolated in stateless mode. This flaw may allow one client's Consul authentication token to be leveraged for subsequent requests made by other clients, effectively enabling unauthorized access or privilege escalation. The vulnerability is classified as high severity due to the potential for authentication token leakage across client sessions. HashiCorp has addressed the issue in consul-mcp-server version 0.1.4. The advisory was published by HashiCorp on their security discussion forum alongside other vulnerabilities affecting the same product. Users running affected versions are strongly advised to upgrade immediately to mitigate the risk of token misuse.