Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: HashiCorp Tooling 1.1.0 Clear all filters
TI-2026-13778 CVE-2026-16498 · GHSA-vq72-755f-9mrm

terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Priority MEDIUM 49

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool ca…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00456 Published 2026-07-28 Fixed in 1.1.0 CWE-488
TI-2026-13776 CVE-2026-16496 · GHSA-4crw-p722-vr7h

terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user

Priority MEDIUM 40

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool cal…

CVSS 3.1HIGH 8.9 Network No auth No interaction EPSS 0.00355 Published 2026-07-28 Fixed in 1.1.0 CWE-384
TI-2026-12537 CVE-2026-14869 · GHSA-rhh5-3xrh-6535

terraform-mcp-server vulnerable to server side request forgery leading to token exposure

Priority MEDIUM 43

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API r…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00394 Published 2026-07-28 Fixed in 1.1.0 CWE-918