VulnSocial

CVE-2026-14869Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-28); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-28: 2Mentions · 2026-08-05: 1Patch / Workaround · 2026-08-05: 1Technical Details · 2026-07-28: 2Technical Details · 2026-08-05: 107-2808-05
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-282
Disclosure2
2026-08-051
Patch1
Full discourse3 posts
  • The Hacker News@TheHackersNews
    Patch

    🚨 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes. Veeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE. HashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869. Django fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution. See what needs patching: https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html

    Post summary

    The article announces that Veeam, HashiCorp Terraform MCP, and Django have released patches for eleven CVEs, detailing credential exposure, file‑write, RCE, tenant isolation, and SSRF flaws.

    3161582525.5K
    2.4M followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-14869 The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated … https://www.cve.org/CVERecord?id=CVE-2026-14869 ----- Traducción: CVE-2026-14869 El … http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑14869, describing it as an SSRF vulnerability in terraform‑mcp‑server versions prior to 1.1.0, linking to its CVE record, but provides no PoC, exploit, or mitigation details.

    0000049
    95 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-14869 The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated … https://www.cve.org/CVERecord?id=CVE-2026-14869

    Post summary

    The post discloses a server‑side request forgery vulnerability (CVE‑2026‑14869) in terraform‑mcp‑server versions before 1.1.0, detailing the affected component and potential attack surface, but it does not provide a PoC, exploit code, or patch information.

    000001.6K
    57.9K followersView on X

Explore more

Back to dashboard