CVE-2026-16326

In consul-mcp-server, versions 0.1.0–0.1.3 fail to properly isolate session state in stateless mode, which may allow one client’s Consul authentication token to be used for subsequent requests from other clients. This is critical (CVSS v3.1: 10.0; AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L). The issue i...