CVE-2026-16498 is a maximum-severity (CVSS 10.0) cross-tenant credential-reuse vulnerability in HashiCorp's Terraform MCP Server when running in stateless Streamable HTTP mode. The underlying MCP library fails to assign unique session identifiers, allowing one user's Terraform token to be reused for subsequent users' requests. Fixed in version 1.1.0.