HashiCorp Patches Critical CVSS 10.0 Cross-Tenant Credential Bug in Terraform MCP Server
A maximum-severity flaw let one user's Terraform token be reused for other users' requests in stateless HTTP mode; two related bugs also patched in version 1.1.0.
Overview
HashiCorp has patched three related vulnerabilities in its Terraform MCP Server, the tool that connects AI assistants to Terraform over the Model Context Protocol, according to a security bulletin the company published on its Discuss forum on July 28, 2026. The most severe of the three, tracked as CVE-2026-16498, carries a maximum CVSS base score of 10.0 and could let one user’s Terraform token be reused to execute tool calls on behalf of other users.
What We Know
All three flaws sit in the server’s streamable-HTTP transport, according to the HashiCorp bulletin, which supports “centralized, multi-user deployments in which each user supplies their own Terraform Cloud or Enterprise token per request for RBAC enforcement.” Deployments that run only in stdio mode, the local single-user setup, are unaffected, as reported by The Hacker News. The affected multi-user HTTP mode is the configuration HashiCorp promoted when it made the server generally available in June, according to the same report.
CVE-2026-16498, the flaw scoring 10.0, affects the server’s stateless HTTP mode. Per HashiCorp’s bulletin, “In stateless HTTP mode the underlying MCP library does not assign unique session identifiers to requests. Because the server’s per-session Terraform client cache relied on session identifiers to distinguish between users, it could not correctly isolate credentials across requests in this mode. This caused the credentials supplied by one tenant to be reused for subsequent requests from other tenants, regardless of the credentials those tenants supplied.” The bug affected only deployments explicitly configured to use stateless HTTP mode, not the default stateful mode or stdio mode.
A second flaw, CVE-2026-16496, is the stateful-mode counterpart and scored 8.9, according to The Hacker News. Stateful mode is the default when the server runs centrally. HashiCorp’s bulletin describes it this way: “The per-session Terraform client cache used the MCP session ID as its sole lookup key and did not bind cached clients to the token that created them. A user who obtained another user’s session ID could supply it in their own request and have their tool calls executed using the victim’s cached Terraform client and bearer token, potentially gaining access to the victim’s Terraform organizations, workspaces, variables, and other resources within the scope of that token’s permissions.” HashiCorp credited this finding to Juan Pablo Martinez Kuhn of Coinspect in the bulletin’s acknowledgement section; the other two flaws were identified internally.
The third bug, CVE-2026-14869, is a server-side request forgery issue scored 8.6, per The Hacker News. HashiCorp’s bulletin explains that “the middleware that processed incoming HTTP requests rejected a client-supplied Terraform address when it was provided as an HTTP header, but did not apply the same check when the same value was supplied as an HTTP query parameter,” letting an unauthenticated remote client redirect the server’s configured bearer token to an attacker-controlled endpoint.
HashiCorp fixed all three issues in version 1.1.0, released July 14, and followed with version 1.2.0 on August 4, according to The Hacker News. The bulletin lists affected versions as 0.2.1 through 1.0.0, while the individual CVE record for CVE-2026-16498 on NVD lists the affected range beginning at version 0.3.0 — a discrepancy The Hacker News noted is unresolved, though both sources agree 1.1.0 is the first fixed release. HashiCorp’s bulletin does not list CVSS scores itself; the numbers come from the individual CVE records the company assigned as the designated CVE Numbering Authority.
HashiCorp’s guidance for operators who cannot upgrade immediately: “restrict network access to the streamable-HTTP listener to trusted users only and treat MCP session IDs as sensitive values,” per the bulletin.
What We Don’t Know
Neither HashiCorp’s bulletin nor NVD’s record indicates the flaws were exploited before disclosure. As of August 5, 2026, none of the three CVEs appeared in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept had surfaced, according to The Hacker News. Neither source has disclosed how many organizations run the affected multi-user HTTP configuration, so the practical exposure across Terraform MCP Server deployments remains unclear.