AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

HashiCorpCVE-2026-16498

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant...

HashiCorp

CVE-2026-16498 · Published Jul 28, 2026 · updated Jul 30, 2026

Critical10.0
Fix: upgrade to 1.1.0 or later
HashiCorp advisory

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

Affected versions

PackageAffectedFixed in
Tooling
Product
>= 0.3.0, < 1.1.01.1.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-488

More HashiCorp advisories

All HashiCorp
Medium 5.3Aug 7HashiCorp Consul: denial of serviceCVE-2026-19113fixed in 2.0.3 +1Medium 4.2Aug 7Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are...CVE-2026-15970fixed in 2.0.3 +1High 8.6Jul 29HashiCorp Tooling: server-side request forgeryCVE-2026-16328fixed in 0.1.4Critical 10.0Jul 29In consul-mcp-serverCVE-2026-16326fixed in 0.1.4High 8.6Jul 28HashiCorp Tooling: server-side request forgeryCVE-2026-14869fixed in 1.1.0High 8.9Jul 28HashiCorp Tooling: session fixationCVE-2026-16496fixed in 1.1.0