CWE-488
- 2
- vulnerabilities tracked
- 2
- critical
- 29 July 2026
- latest publication
cve
Vulnerability watch
idvulnerabilityseveritypublished
CVE-2026-16326In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4. Critical CVSS 10 CVE-2026-16498The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0. Critical CVSS 10