The vulnerability is a session isolation weakness (CWE‑488) in consul‑mcp‑server when operating in stateless mode. A legitimate client’s authentication token can be captured by another client, allowing malicious actors to impersonate other tenants and perform actions on their behalf.

HashiCorp’s consul‑mcp‑server, versions 0.1.0 through 0.1.3, running in stateless mode with streamable‑HTTP.

The CVSS score of 10 reflects a severe, full‑breach risk. The EPSS score of less than 1% indicates a low probability of exploitation at present, yet the vulnerability remains exploitable via malicious network traffic to the stateless endpoint. It is not listed in CISA’s KEV catalog. If an attacker can send crafted requests, they can reuse a valid authentication token from one tenant for subsequent requests from another tenant, bypassing tenant isolation.