A critical session isolation vulnerability in HashiCorp consul-mcp-server exposes sensitive authentication tokens, allowing cross-client impersonation.

The application does not properly isolate session state in stateless mode, which allows for the leakage of authentication tokens between different clients. This is an unauthenticated vulnerability that impacts the confidentiality and integrity of the session management process.

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. Successful exploitation allows an attacker to hijack the sessions of other users or gain unauthorized access to resources by assuming the identity of another client, potentially leading to a complete compromise of the Consul environment.

Immediate Action: Upgrade the consul-mcp-server component to version 0.1.4 or later to ensure proper session isolation.

Proactive Monitoring: Audit access logs for suspicious token usage patterns where a single token appears to be associated with multiple distinct client identities or IP addresses.

Compensating Controls: Implement strict network-level access controls to limit the exposure of the consul-mcp-server until the patch can be deployed.

Public Exploit Available: Unknown

This vulnerability demands immediate attention due to its potential for total session compromise. Administrators must prioritize updating the consul-mcp-server software to the fixed version to prevent unauthorized impersonation and potential data breaches within the HashiCorp ecosystem.