CVE-2026-16498

Critical

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless…

HashiCorp·CWE-488·Published 2026-07-28

CVSS

10.0

EPSS

0.00

KEV

Exploits

cve.orgen

330 chars

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

NVDen

330 chars

NVDes

406 chars

El terraform-mcp-server anterior a la versión 1.1.0 es vulnerable a un problema de reutilización de credenciales entre inquilinos en el modo de transporte sin estado HTTP transmisible que puede permitir que el token de Terraform de un usuario se utilice para ejecutar llamadas de herramientas en nombre de usuarios posteriores. Esta vulnerabilidad, CVE-2026-16498, se corrige en terraform-mcp-server 1.1.0.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	10.0	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
3.1	Secondary	NVD	10.0	3.9	6.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
3.1	Secondary	ENISA EUVD	10.0	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L