CVE-2026-16498

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El terraform-mcp-server anterior a la versión 1.1.0 es vulnerable a un problema de reutilización de credenciales entre inquilinos en el modo de transporte sin estado HTTP transmisible que puede permitir que el token de Terraform de un usuario se utilice para ejecutar llamadas de herramientas en nombre de usuarios posteriores. Esta vulnerabilidad, CVE-2026-16498, se corrige en terraform-mcp-server 1.1.0.

Information

Published : 2026-07-28 19:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-16498

Mitre link : CVE-2026-16498

CVE.ORG link : CVE-2026-16498

JSON object : View

Products Affected

No product.

CWE

CWE-488

Exposure of Data Element to Wrong Session

{"id": "CVE-2026-16498", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16498", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T18:38:22.534995Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@hashicorp.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@hashicorp.com", "affectedData": [{"repo": "https://github.com/hashicorp/terraform-mcp-server", "vendor": "HashiCorp", "product": "Tooling", "versions": [{"status": "affected", "version": "0.3.0", "lessThan": "1.1.0", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-07-28T19:17:32.117", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606", "source": "security@hashicorp.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@hashicorp.com", "description": [{"lang": "en", "value": "CWE-488"}]}], "descriptions": [{"lang": "en", "value": "The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0."}, {"lang": "es", "value": "El terraform-mcp-server anterior a la versi\u00f3n 1.1.0 es vulnerable a un problema de reutilizaci\u00f3n de credenciales entre inquilinos en el modo de transporte sin estado HTTP transmisible que puede permitir que el token de Terraform de un usuario se utilice para ejecutar llamadas de herramientas en nombre de usuarios posteriores. Esta vulnerabilidad, CVE-2026-16498, se corrige en terraform-mcp-server 1.1.0."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security@hashicorp.com"}