Skip to content
CVSS 10.0CVSS 10.0 · CRITICAL

CVE-2026-16498Token leakage in terraform-mcp-server

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

View on NVD

Analysis

El servidor terraform-mcp-server presenta una vulnerabilidad crítica de reutilización de credenciales entre diferentes usuarios en su modo de transporte HTTP. Un atacante podría obtener y utilizar tokens de Terraform ajenos para ejecutar comandos y modificar infraestructura en nombre de otros usuarios. Se recomienda actualizar inmediatamente a la versión 1.1.0 para mitigar este riesgo.

Relevant roles

CloudBackendIACyberSecurity

Severity

Score: 10.0(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: CHANGED
C: HIGH
I: HIGH
A: LOW
Weakness (CWE): CWE-488

EPSS

No EPSS score yet (CVE may be too fresh).

Technical description

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

Published: 7/28/2026, 7:17:32 PM
Last modified: 7/28/2026, 7:17:32 PM

References

HomeEventsBlogResourcesCoursesTeam