Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug
HashiCorp, Veeam, and the Django Software Foundation have released patches for 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and…
Tag: Terraform MCP Server
CVE-2026-16498: Critical Cross-Tenant Credential Reuse in Terraform MCP Server
CVE-2026-16498 is a maximum-severity (CVSS 10.0) cross-tenant credential-reuse vulnerability in HashiCorp's Terraform MCP Server when running in stateless Streamable HTTP mode. The…
CVE-2026-16496: Stateful Mode Session Isolation Failure in Terraform MCP Server
CVE-2026-16496 (CVSS 8.9) is a stateful-mode session isolation flaw in Terraform MCP Server. The credential cache uses the MCP session ID as…
CVE-2026-14869: Server-Side Request Forgery in Terraform MCP Server
CVE-2026-14869 (CVSS 8.6) is a server-side request forgery vulnerability in Terraform MCP Server's Streamable HTTP transport. Request middleware rejects a client-supplied Terraform…
HashiCorp Fixes Critical Terraform MCP Server Vulnerabilities
HashiCorp released Terraform MCP Server version 1.1.0 to address three vulnerabilities in the Streamable HTTP transport, including a CVSS 10.0 cross-tenant credential…
Terraform MCP Server: Critical Vulnerabilities Fixed in Version 1.1.0
HashiCorp's Terraform MCP Server, which connects AI assistants to Terraform over the Model Context Protocol, had three vulnerabilities in its Streamable HTTP…
Coinspect Researcher Reported Terraform MCP Flaw
Juan Pablo Martinez Kuhn of Coinspect reported CVE-2026-16496, a stateful-mode session isolation flaw in Terraform MCP Server. HashiCorp found the other two…