Consul vulnerabilities and fixes

CVEs that mention Consul, ranked by priority. 2 tracked.

Consul has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-07-29. Highest priority: CVE-2026-16326 (score 51/100).

• CVE-2026-16326 CRITICAL 10.0 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, whi
• CVE-2026-16328 HIGH 8.6 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied,

FAQ

How do I fix Consul vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Consul being exploited right now?

None of the tracked Consul CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Consul CVE should I patch first?

CVE-2026-16326 currently ranks highest (51/100): In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, whi.

← Back to latest CVEs