What happened
HashiCorp disclosed on 2026-07-29 that consul-mcp-server's stateless mode does not isolate session state between clients, allowing token reuse across clients, and that the Consul backend address is client-overridable, enabling SSRF-style credential exfiltration to attacker infrastructure.
Why it matters
This is the same credential-isolation failure class as the terraform-mcp-server bulletin published one day earlier by the same vendor, showing a systemic pattern across HashiCorp's MCP server line: multi-tenant AI-agent deployments of infrastructure-management MCP servers can leak credentials across tenant boundaries.
Attack vector
In stateless mode, one client's Consul authentication token can be used for subsequent, unrelated clients' requests (CVE-2026-16326, CVSS 10.0). A companion flaw (CVE-2026-16328, CVSS 8.6) lets a connected client override the server's configured Consul backend address via a request header, redirecting the server's Consul API traffic — and its auth token — to an attacker-controlled endpoint.
Affected systems
hashicorp/consul-mcp-server 0.1.0 up to 0.1.3
Mitigation
Upgrade to consul-mcp-server 0.1.4. See HashiCorp Security Bulletin HCSEC-2026-24.