Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug
HashiCorp, Veeam, and the Django Software Foundation have released patches for 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and…
Tag: HashiCorp
CVE-2026-16498: Critical Cross-Tenant Credential Reuse in Terraform MCP Server
CVE-2026-16498 is a maximum-severity (CVSS 10.0) cross-tenant credential-reuse vulnerability in HashiCorp's Terraform MCP Server when running in stateless Streamable HTTP mode. The…
CVE-2026-16496: Stateful Mode Session Isolation Failure in Terraform MCP Server
CVE-2026-16496 (CVSS 8.9) is a stateful-mode session isolation flaw in Terraform MCP Server. The credential cache uses the MCP session ID as…
CVE-2026-14869: Server-Side Request Forgery in Terraform MCP Server
CVE-2026-14869 (CVSS 8.6) is a server-side request forgery vulnerability in Terraform MCP Server's Streamable HTTP transport. Request middleware rejects a client-supplied Terraform…
HashiCorp Fixes Critical Terraform MCP Server Vulnerabilities
HashiCorp released Terraform MCP Server version 1.1.0 to address three vulnerabilities in the Streamable HTTP transport, including a CVSS 10.0 cross-tenant credential…
Terraform MCP Server: Critical Vulnerabilities Fixed in Version 1.1.0
HashiCorp's Terraform MCP Server, which connects AI assistants to Terraform over the Model Context Protocol, had three vulnerabilities in its Streamable HTTP…