CRITICAL 10.0 NVD

CVE-2026-16498

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may al

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

References

https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp

Published: 2026-07-28 · Source: NVD · Feed updated: 2026-08-04

This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-07-28 via NVD.

Risk Timeline

CVE Disclosed2026-07-28 · 6 days ago

Remediation Resources

Official Advisory

discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacti

vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.