CVE-2026-16498
Received Received - Intake

Cross-Tenant Credential Reuse in Terraform MCP Server

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: HashiCorp Inc.

Description
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-16498
EUVD
EUVD-2026-49941

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
hashicorp terraform_mcp_server to 1.1.0 (exc)
hashicorp terraform_mcp_server 0.2.1
hashicorp terraform_mcp_server 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-488 The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16498 is a cross-tenant credential reuse vulnerability in HashiCorp Terraform MCP Server versions 0.2.1 through 1.0.0 when using stateless HTTP mode. The server fails to isolate credentials properly due to missing unique session identifiers, causing one user's Terraform token to be reused for other users' requests.

Detection Guidance

Check if your terraform-mcp-server is running version 0.2.1 through 1.0.0 by running: terraform-mcp-server --version. If using stateless HTTP mode, verify if credentials are being reused across users by inspecting server logs for unexpected token usage patterns.

Impact Analysis

This vulnerability allows unauthorized access to resources within the original user's token permissions. Attackers could exploit it to perform actions on behalf of other users without their credentials, potentially leading to data breaches or resource misuse.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade terraform-mcp-server to version 1.1.0 or later immediately. If upgrading is not possible, disable stateless HTTP mode and switch to stateful mode to enforce proper credential isolation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16498. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart