CVE-2026-16328

Name of the Vulnerable Software and Affected Versions consul-mcp-server versions 0.1.0 through 0.1.3

Description The software does not restrict how the Consul backend address is supplied, which allows a connected client to override the configured Consul address using a request header. A malicious client could redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially leading to the exfiltration of the Consul token configured on the server.

Recommendations Update consul-mcp-server to version 0.1.4.