VulnSocial

CVE-2026-16496Disclosure

LOWCVSS 8.9 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability, CVE-2026-16496, is fixed in terraform-mcp-server 1.1.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-384

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 2 mentions (2026-07-28); latest day: 2
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01122Mentions · 2026-07-28: 2Mentions · 2026-08-04: 1Mentions · 2026-08-05: 2Patch / Workaround · 2026-08-04: 1Patch / Workaround · 2026-08-05: 1Technical Details · 2026-07-28: 2Technical Details · 2026-08-04: 1Technical Details · 2026-08-05: 107-2808-0408-05
Signal classification2 categories
Disclosure
360.0%
Patch
240.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-282
Disclosure2
2026-08-041
Patch1
2026-08-052
Disclosure1Patch1
Full discourse5 posts
  • The Hacker News@TheHackersNews
    Patch

    🚨 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes. Veeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE. HashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869. Django fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution. See what needs patching: https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html

    Post summary

    The post lists several CVEs that have been patched by vendors and summarizes their technical impact, but provides no evidence of active exploitation or available PoC code.

    3161582525.5K
    2.4M followersView on X
  • yousukezan@yousukezan
    Patch

    HashiCorpはTerraform MCP Serverで3件の脆弱性を修正した。このうちCVE-2026-16498はCVSS 10.0の深刻な脆弱性で、マルチユーザー環境において他ユーザーのTerraform認証トークンが利用される恐れがある。いずれも共有環境でのトークン漏えいにつながる可能性があり、修正版の1.1.0が公開されている。 影響を受けるのはterraform-mcp-server 0.2.1から1.0.0までで、streamable-HTTPを利用したマルチユーザー環境が対象となる。単一ユーザー向けのstdioモードは影響を受けない。CVE-2026-16498では、ステートレスモードでセッション分離が不十分だったため、別ユーザーのTerraformトークンが他ユーザーの要求に利用される可能性がある。CVE-2026-16496（CVSS 8.9）では、ステートフルモードのクライアントキャッシュがセッションIDのみを基準に管理されており、セッションIDを取得した攻撃者が被害者のキャッシュ済みトークンを利用してTerraformワークスペースへアクセスできる可能性がある。 さらにCVE-2026-14869（CVSS 8.6）は認証不要のSSRFで、HTTPヘッダーではTerraformアドレスを検証していたものの、クエリパラメータでは検証しておらず、攻撃者がBearerトークンを自身のサーバーへ送信させることが可能となる。HashiCorpはTerraform MCP Server 1.1.0への更新を推奨しており、更新できない場合はstreamable-HTTPへのアクセスを信頼できる利用者に限定し、MCPのセッションIDを機密情報として扱うよう案内している。現時点で悪用は確認されていない。 https://securityonline.info/terraform-mcp-cve-2026-16498/

    Post summary

    HashiCorp released update 1.1.0 to fix three high‑severity vulnerabilities in Terraform MCP Server, detailing token leakage, session isolation, and SSRF issues, with no evidence of active exploitation.

    020641.6K
    16.0K followersView on X
  • Coinspect Security@coinspect
    Disclosure

    From an MCP session ID to another user’s Terraform credentials: Juan Pablo Martínez Kuhn, who leads Coinspect’s consulting team, uncovered CVE-2026-16496, a high-severity flaw in HashiCorp’s Terraform MCP Server.

    Post summary

    The user reports discovering a new high‑severity flaw, CVE-2026-16496, in HashiCorp’s Terraform MCP Server, but provides no evidence of an existing PoC, exploit, or patch.

    140421.2K
    3.2K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-16496 The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtain… https://www.cve.org/CVERecord?id=CVE-2026-16496

    Post summary

    The text announces an authorization bypass vulnerability in terraform-mcp-server versions prior to 1.1.0, detailing the affected transport mode but offering no PoC, patch, or active exploitation information.

    00010603
    57.9K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-16496 The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtain… https://www.cve.org/CVERecord?id=CVE-2026-16496 ----- Traducción: CVE-2026-16496 El … http://infoflow.cloud`

    Post summary

    CVE-2026-16496 is an authorization bypass vulnerability affecting terraform‑mcp‑server versions before 1.1.0; no PoC, exploit tool, or patch has been disclosed.

    0000035
    95 followersView on X

Explore more

Back to dashboard