Skip to content
OpenAdvisories
High WID-SEC-2026-2572 3 CVEs

Hashicorp Terraform MCP Server: Mehrere Schwachstellen

Published Jul 28, 2026 · Updated Jul 28, 2026 · de-DE

Vendor: HashiCorp Product: Terraform Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Hashicorp Terraform MCP Server ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.

Product

Terraform ist ein Infrastruktur-als-Code-Tool.

Vulnerabilities 3

  • Critical 10.0
    CVE-2026-16498

    terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

    The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This…

    HashiCorp Tooling
  • High 8.9
    CVE-2026-16496

    terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user

    The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform…

    HashiCorp Tooling
  • High 8.6
    CVE-2026-14869

    terraform-mcp-server vulnerable to server side request forgery leading to token exposure

    The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorizat…

    HashiCorp Tooling

Revision history

  1. #1

    Initiale Fassung

References