Root cause
SSRF & network boundaries introduced
The initial server implementation read an address from the X-Consul-Address request header and stored it in the request context for the client builder to apply to the Consul endpoint.
An AI-assisted change let a connecting client pick the Consul API address with a request header, so the server could be pointed at an attacker-controlled endpoint and send along the Consul token it was configured with.
How AI contributed: Direct introductionPublished Jul 29, 2026 in 
hashicorp/consul-mcp-serverAll 2 findings in this repository
Show full advisory descriptionHide advisory description
The server bridges MCP clients to a Consul cluster and is deployed with one Consul endpoint and one Consul token. The request path let the client choose that endpoint: a header put an address into the request context, and the client builder replaced the configured address with it, so the server's own credentials stayed attached to the redirected call. Anyone able to reach the server could send its Consul API traffic to a host they controlled and observe the Consul token travelling with it. The hardening change removes the header read and the context override and keeps the Consul address on the server's CONSUL_HTTP_ADDR setting, which closes the redirect.
What actually happenedHide details
The request middleware copied an X-Consul-Address header into the request context, and the client builder used that value as the Consul address for every API call made while handling the request. A client could therefore redirect the server's Consul traffic to an endpoint it controlled and read the configured Consul token from the outgoing request the server sent there.
Fix
Security fix
The client hardening change deletes the header read and the context override, so the Consul endpoint comes only from the server's own CONSUL_HTTP_ADDR configuration.
Fix by Sanika Chavan · no AI marker found
Case facts
- CVE ID
- CVE-2026-16328
- GHSA ID
- GHSA-5H6C-295F-7PP3
- Published
- Jul 29, 2026
- Severity
- Not scored
- Language
- Go
- AI tool
GitHub Copilot- AI role
- Direct introduction
- Vulnerable release
- v0.1.1
- Fixed release
- v0.1.4
AI-assisted change
AI-assisted changepkg/client/middleware.gosource hashicorp/consul-mcp-server@b1cd635f74+6−0
@@ -0,0 +141,6 @@+ // Extract Consul address from header+ consulAddr := r.Header.Get(textproto.CanonicalMIMEHeaderKey("X-Consul-Address"))+ if consulAddr != "" {+ ctx = context.WithValue(ctx, "consul_address", consulAddr)Show 2 hidden lines
+ logger.Debugf("consul_address: %s", consulAddr)+ }The middleware takes the address from the X-Consul-Address header and puts it in the request context for the client builder.
AI-assisted changepkg/client/consul_client.gosource hashicorp/consul-mcp-server@b1cd635f74+6−0
@@ -0,0 +65,6 @@+ // override the address and token from session context if available+ if addr, ok := ctx.Value("consul_address").(string); ok && addr != "" {+ address = addr+ }Show 2 hidden lines
++ if tkn, ok := ctx.Value("consul_token").(string); ok && tkn != "" {The client builder replaces the configured Consul address with the value it finds in the request context.
Security fix
Fixpkg/client/middleware.gosource hashicorp/consul-mcp-server@af8a9df316+1−5
@@ -141,5 +138,1 @@ func NewSecurityHandler(handler http.Handler, allowedOrigins []string, corsMode- // Extract Consul address from header- consulAddr := r.Header.Get(textproto.CanonicalMIMEHeaderKey("X-Consul-Address"))- if consulAddr != "" {- ctx = context.WithValue(ctx, "consul_address", consulAddr)Show 2 hidden lines
- logger.Debugf("consul_address: %s", consulAddr)+ sessionID := r.Header.Get(server.HeaderKeySessionID)The fix deletes the header read, so a request can no longer place an address in the context.
Fixpkg/client/consul_client.gosource hashicorp/consul-mcp-server@af8a9df316+2−6
@@ -67,6 +72,2 @@ func NewConsulClient(ctx context.Context, sessionId string, logger *log.Logger)- // override the address and token from session context if available- if addr, ok := ctx.Value("consul_address").(string); ok && addr != "" {- address = addr- }Show 4 hidden lines
-- if tkn, ok := ctx.Value("consul_token").(string); ok && tkn != "" {+ // Override the token from request context if available. The Consul address+ // is intentionally only read from CONSUL_HTTP_ADDR.The fix drops the context override and records that the Consul address now comes only from the server's configuration; only the token still comes from the request.