CVE-2026-16326criticalCWE-488

CVE-2026-16326: falha crítica em HashiCorp Tooling

consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Publicada em

Seguir esta CVE+ Monitorar Tooling

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 0.5%
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Produtos afetados
HashiCorp · Tooling
CVEs relacionadas — HashiCorp Tooling

No mesmo produto, das mais perigosas para as menos.

CVE-2026-4660HIGHGo-getter may allow to arbitrary filesystem reads through git operationsEPSS 0.6%CVE-2025-13357HIGHVault Terraform Provider Applied Incorrect Defaults for LDAP Auth MethodEPSS 0.5%CVE-2026-8715CRITICALVault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPathEPSS 0.5%CVE-2026-16498CRITICALterraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeEPSS 0.5%CVE-2026-16328HIGHconsul-mcp-server vulnerable to server side request forgery leading to token exposureEPSS 0.4%CVE-2026-14869HIGHterraform-mcp-server vulnerable to server side request forgery leading to token exposureEPSS 0.4%