Aller au contenu
en Se connecter
8.6 Élevée

CVE-2026-16328 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied,…

Description

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially exfiltrating the Consul token configured on the server. This vulnerability, CVE-2026-16328, is fixed in consul-mcp-server 0.1.4.

Produits et versions touchés

Produit Versions touchées Corrigé en
Tooling 0.1 0.1.0 → < 0.1.4 0.1.4

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Tooling

Les 13 CVE de Tooling →
CVE-2026-110720 Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding… 9.9 Critique CVE-2026-87993 The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow… 7.7 Élevée CVE-2026-8715 Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in… 9.6 Critique CVE-2026-16326 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may… 10.0 Critique
Suivre cette CVE