Do Son 
TL;DR
HashiCorp patched three bugs in its Terraform MCP Server. The worst Terraform MCP Server flaw, CVE-2026-16498, earns a maximum 10.0 CVSS. All three can expose Terraform tokens in multi-user setups. Version 1.1.0 fixes them.
- Product: HashiCorp Tooling
- Vulnerabilities: 3 flaws (CVE-2026-16498, CVE-2026-16496, CVE-2026-14869)
- Highest severity: 10.0 (Critical · CVSSv3)
- Worst impact: terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- Status: No confirmed exploitation yet; patches available
- Action: Update to 1.1.0 now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-16498 | 10 | CWE-488 | 1.1.0 | Not exploited |
| CVE-2026-16496 | 8.9 | CWE-384 | 1.1.0 | Not exploited |
| CVE-2026-14869 | 8.6 | CWE-918 | 1.1.0 | Not exploited |
Why it matters
MCP servers let AI agents call real tools. This one bridges assistants to Terraform Cloud and Enterprise. So a leaked token can hand an attacker control of cloud infrastructure.
The flaws hit only the streamable-HTTP transport used for central, multi-user deployments. Single-user stdio mode stays safe. Still, that shared mode is exactly how teams run these servers at scale.
How the attacks work
CVE-2026-16498 is the headline bug. In stateless mode, the server failed to isolate sessions. As a result, one tenant’s Terraform token could serve another tenant’s requests, whatever credentials they supplied.
CVE-2026-16496, rated 8.9, targets stateful mode, the default for central use. It keyed its client cache on the session ID alone. So a user who steals a session ID can ride the victim’s cached token and reach their workspaces.
An unauthenticated SSRF
CVE-2026-14869 scores 8.6 and needs no login. The server checked a client-supplied Terraform address in HTTP headers but not in query parameters. That gap let an attacker redirect the server’s bearer token to their own endpoint.
Affected versions
The bugs affect terraform-mcp-server 0.2.1 up to and including 1.0.0. HashiCorp’s internal team found them. A sister advisory covers its Consul MCP Server too.
Patch and mitigation
Upgrade to terraform-mcp-server 1.1.0 as soon as you can. If you cannot, restrict the streamable-HTTP listener to trusted users. Also treat MCP session IDs as secrets. Read the official HashiCorp advisory for full guidance. HashiCorp has not reported any in-the-wild exploitation of this Terraform MCP Server flaw.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
