CVEs published by HashiCorp Inc.

CVEs published by HashiCorp Inc. (CVE Numbering Authority). 7 tracked.

CVE-2026-16326 CRITICAL 10.0 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, whi
CVE-2026-16328 HIGH 8.6 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied,
CVE-2026-16498 CRITICAL 10.0 The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the st
CVE-2026-14869 HIGH 8.6 The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the stre
CVE-2026-16496 HIGH 8.9 The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP
CVE-2026-14886 HIGH 8.2 Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypa
CVE-2026-19589 HIGH 7.1 Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended fi