HCSEC-2026-23 - Multiple vulnerabilities impacting HashiCorp Terraform MCP Server - Security - HashiCorp Discuss

= 40rem)" rel="stylesheet" data-target="discourse-ai_desktop" /><br>= 40rem)" rel="stylesheet" data-target="discourse-reactions_desktop" /><br>= 40rem)" rel="stylesheet" data-target="poll_desktop" />

= 40rem)" rel="stylesheet" data-target="desktop_theme" data-theme-id="19" data-theme-name="discourse-hashicorp-theme"/>

HCSEC-2026-23 - Multiple vulnerabilities impacting HashiCorp Terraform MCP Server

Security

security-terraform

james.warren

July 28, 2026, 5:50pm

Bulletin ID: HCSEC-2026-23

Affected Products / Versions: terraform-mcp-server 0.2.1 up to and including 1.0.0; fixed in 1.1.0.

Publication Date: July 28, 2026

Summary

The terraform-mcp-server before version 1.1.0 is vulnerable to three related issues in its streamable-HTTP transport: a server-side request forgery issue that may allow an unauthenticated client to redirect the server’s bearer token to an attacker-controlled endpoint (CVE-2026-14869), an authorization bypass in stateful mode that may allow an authenticated user to access another user’s cached Terraform credentials (CVE-2026-16496), and a cross-tenant credential reuse issue in stateless mode that may allow one user’s Terraform token to be used for subsequent users’ requests (CVE-2026-16498). All three vulnerabilities are fixed in terraform-mcp-server 1.1.0.

Background

The terraform-mcp-server supports a streamable-HTTP transport mode for centralized, multi-user deployments in which each user supplies their own Terraform Cloud or Enterprise token per request for RBAC enforcement. In this mode the server can operate statelessly, where each request is handled independently, or statefully, where it maintains a per-session Terraform API client cache to avoid reconstructing a client on every tool call. The server also accepts configuration for the Terraform endpoint address and authenticates to that endpoint using a server-side bearer token.

Details

CVE-2026-14869: Server-side request forgery via client-supplied Terraform address

The middleware that processed incoming HTTP requests rejected a client-supplied Terraform address when it was provided as an HTTP header, but did not apply the same check when the same value was supplied as an HTTP query parameter. An unauthenticated remote client could include the Terraform address as a query parameter, causing the server to pair the attacker-supplied address with its configured bearer token and transmit that token to the attacker-controlled endpoint. Exploitation required only the ability to send an HTTP request to the streamable-HTTP listener, with no authentication required. Deployments using stdio mode exclusively were not affected.

CVE-2026-16496: Authorization bypass via session credential cache in stateful mode

The per-session Terraform client cache used the MCP session ID as its sole lookup key and did not bind cached clients to the token that created them. A user who obtained another user’s session ID could supply it in their own request and have their tool calls executed using the victim’s cached Terraform client and bearer token, potentially gaining access to the victim’s Terraform organizations, workspaces, variables, and other resources within the scope of that token’s permissions. This issue affected only deployments using stateful streamable-HTTP mode, which is the default when running the server centrally; stdio mode and stateless HTTP mode were not affected.

CVE-2026-16498: Cross-tenant credential reuse in stateless mode

In stateless HTTP mode the underlying MCP library does not assign unique session identifiers to requests. Because the server’s per-session Terraform client cache relied on session identifiers to distinguish between users, it could not correctly isolate credentials across requests in this mode. This caused the credentials supplied by one tenant to be reused for subsequent requests from other tenants, regardless of the credentials those tenants supplied. This issue affected only deployments explicitly configured to use stateless HTTP mode; deployments using the default stateful HTTP mode or stdio mode were not affected.

Remediation

Customers should evaluate the risk associated with these issues and consider upgrading to terraform-mcp-server 1.1.0. Operators who cannot upgrade immediately should restrict network access to the streamable-HTTP listener to trusted users only and treat MCP session IDs as sensitive values.

Acknowledgement

CVE-2026-16496 was reported to HashiCorp by Juan Pablo Martinez Kuhn of Coinspect. CVE-2026-14869 and CVE-2026-16498 were identified by an internal team.

We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.

Related topics

Topic

Replies<br>Views<br>Activity

Terraform vulnerability for version 1.5.7...