CVE-2026-16496
Received Received - Intake

Authorization Bypass in Terraform MCP Server

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: HashiCorp Inc.

Description
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability, CVE-2026-16496, is fixed in terraform-mcp-server 1.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-16496
EUVD
EUVD-2026-49940

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hashicorp terraform_mcp_server to 1.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The terraform-mcp-server before version 1.1.0 has an authorization bypass in its streamable-HTTP stateful transport mode. This allows someone who gets another user's MCP session ID to make tool calls using that user's Terraform credentials.

Detection Guidance

This vulnerability involves an authorization bypass in terraform-mcp-server's streamable-HTTP mode. To detect it, check if your terraform-mcp-server version is below 1.1.0. Run: terraform-mcp-server --version. If the version is older, update immediately. Monitor network traffic for unauthorized MCP session ID usage or unexpected tool calls.

Impact Analysis

If an attacker obtains your MCP session ID, they could execute Terraform operations under your identity, potentially leading to unauthorized infrastructure changes, data breaches, or resource misuse.

Compliance Impact

This vulnerability could lead to unauthorized access and data exposure, violating compliance requirements like GDPR's data protection principles or HIPAA's access controls, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade terraform-mcp-server to version 1.1.0 or later to address the authorization bypass vulnerability in the streamable-HTTP stateful transport mode.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart