What is GHSA-6c5r-pj95-xvqv?

GHSA-6c5r-pj95-xvqv is a security advisory published by GitHub Security Advisories with Critical severity. In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in...

Which CVE IDs does GHSA-6c5r-pj95-xvqv cover?

GHSA-6c5r-pj95-xvqv covers the following CVE IDs: CVE-2026-16326. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6c5r-pj95-xvqv?

GHSA-6c5r-pj95-xvqv has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

GHSA-6c5r-pj95-xvqvCriticalCVSS 10.0

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in...

Vendor

GitHub Security Advisories

Published

July 29, 2026

Last Modified

July 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-16326 →

📋 Description

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16326
https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612
https://github.com/advisories/GHSA-6c5r-pj95-xvqv