CVE-2026-14869 (CVSS 8.6) is a server-side request forgery vulnerability in Terraform MCP Server's Streamable HTTP transport. Request middleware rejects a client-supplied Terraform address when sent as an HTTP header but not when provided as a query parameter, allowing an unauthenticated attacker to make the server send its bearer token to an attacker-controlled endpoint. Fixed in version 1.1.0.