CVE-2026-16498Patch

MEDIUMCVSS 10.0 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606

Weakness type (CWE)

CWE-488

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
13 mentions across 7 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 9 signals
Technical details provided in 13 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 3d ago at 3 mentions (2026-08-05); latest day: 1
13 total mentions across 7 days

Deep dive

Activity timeline13 mentions / 7d

Signal classification4 categories

Patch

753.8%

Disclosure

430.8%

General

17.7%

Active Exploitation

17.7%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-28	2	Disclosure1General1
2026-07-29	1	Disclosure1
2026-08-04	2	Patch2
2026-08-05	3	Patch3
2026-08-06	3	Active Exploitation1Disclosure1Patch1
2026-08-11	1	Patch1
2026-09-22	1	Disclosure1

Full discourse13 posts

The Hacker News@TheHackersNews85d
Patch
🚨 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes. Veeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE. HashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869. Django fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution. See what needs patching: https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html
Post summary
The article announces that Veeam, Terraform MCP, and Django have released patches for several CVEs, describing the types of vulnerabilities addressed but providing no proof of exploitation or PoC details.
3161582525.5K
2.4M followersView on X
ɐpnH@AlAssaf_H85d
Patch
A critical Terraform MCP Server flaw, CVE-2026-16498, affects CVSS 10.0. Three bugs threaten Terraform token theft and cross-tenant reuse. Update to 1.1.0. https://securityonline.info/terraform-mcp-cve-2026-16498/
Post summary
The post describes a critical Terraform MCP Server vulnerability (CVE‑2026‑16498) with a CVSS score of 10.0, highlighting token theft and cross‑tenant reuse, and urges updating to version 1.1.0.
070116660
926 followersView on X
Daily CyberSecurity@Daily_CyberSec86d
Patch
A critical Terraform MCP Server flaw, CVE-2026-16498, hits CVSS 10.0. Three bugs risk Terraform token theft and cross-tenant reuse. Upgrade to 1.1.0. #HashiCorp #Terraform #MCP #CVE202616498 #Vulnerability #InfoSec http://securityonline.info/terraform-mcp-cve-2026-16498/
Post summary
The message announces the critical Terraform MCP Server flaw CVE-2026-16498, gives key technical details such as a CVSS 10.0 score and token theft risk, and advises upgrading to version 1.1.0.
0301541.1K
13.0K followersView on X
yousukezan@yousukezan86d
Patch
HashiCorpはTerraform MCP Serverで3件の脆弱性を修正した。このうちCVE-2026-16498はCVSS 10.0の深刻な脆弱性で、マルチユーザー環境において他ユーザーのTerraform認証トークンが利用される恐れがある。いずれも共有環境でのトークン漏えいにつながる可能性があり、修正版の1.1.0が公開されている。影響を受けるのはterraform-mcp-server 0.2.1から1.0.0までで、streamable-HTTPを利用したマルチユーザー環境が対象となる。単一ユーザー向けのstdioモードは影響を受けない。CVE-2026-16498では、ステートレスモードでセッション分離が不十分だったため、別ユーザーのTerraformトークンが他ユーザーの要求に利用される可能性がある。CVE-2026-16496（CVSS 8.9）では、ステートフルモードのクライアントキャッシュがセッションIDのみを基準に管理されており、セッションIDを取得した攻撃者が被害者のキャッシュ済みトークンを利用してTerraformワークスペースへアクセスできる可能性がある。さらにCVE-2026-14869（CVSS 8.6）は認証不要のSSRFで、HTTPヘッダーではTerraformアドレスを検証していたものの、クエリパラメータでは検証しておらず、攻撃者がBearerトークンを自身のサーバーへ送信させることが可能となる。HashiCorpはTerraform MCP Server 1.1.0への更新を推奨しており、更新できない場合はstreamable-HTTPへのアクセスを信頼できる利用者に限定し、MCPのセッションIDを機密情報として扱うよう案内している。現時点で悪用は確認されていない。 https://securityonline.info/terraform-mcp-cve-2026-16498/
Post summary
HashiCorp released patch 1.1.0 for three critical vulnerabilities in Terraform MCP Server, detailing token leakage and SSRF risks, with no active exploitation reported.
020641.6K
16.0K followersView on X
ボス@サイバーセキュリティの専門家@boss_sec_labo83d
Active Exploitation
パッチを当てる前に、すでに動いている——それが今日の4本の共通点だ。 CVSS 9.8超えが3本、CVSS 10.0が1本。CI/CDが突破され、VPNが破られ、100組織超に通知された。「積極悪用中」はそういう意味だ。・TeamCity CVE-2026-63077、CISA KEV登録——CI/CDへの未認証RCE ・Terraform MCP CVE-2026-16498、CVSS 10.0——クロステナント認証情報漏洩・Oracle PeopleSoft CVE-2026-35273——Mandiant、100組織超に通知・Check Point VPN CVE-2026-50751——Qilinランサムが認証なしで侵入今日中に確認すること——CI/CDとVPNのバージョン確認、そして5月以降のアクセスログの精査。その作業を後回しにする理由はひとつもない。君の現場でまだ動いていないパッチは何本残っている？
Post summary
The message lists four CVEs with high CVSS, notes active exploitation by ransomware and notifications from Mandiant, and urges immediate patch verification.
00011330
1.4K followersView on X
SecPod@SecPod84d
Patch
🚨 11 vulnerabilities patched across Terraform MCP Server, Veeam Service Provider Console, and Django. The most critical, CVE-2026-16498 with a CVSS 10.0 score, can break tenant isolation by reusing one user’s Terraform token for another user’s requests. Other flaws could enable credential theft, RCE, SSRF, file writes, and denial of service. Review affected versions and patch now: https://www.secpod.com/learn/security-research/terraform-mcp-veeam-console-django-push-critical-patches-11-cv-es-fixed-including-cvss-10-0-cross-tenant-token-reuse-flaw #CyberSecurity #Terraform #Veeam #Django #VulnerabilityManagement #PatchManagement
Post summary
A patch alert for 11 vulnerabilities affecting Terraform MCP Server, Veeam Service Provider Console, and Django, highlighting the top CVE‑2026‑16498 with a CVSS 10.0 score and urging immediate patching.
1000066
540 followersView on X
Xavier Rivera@XavierRiveraX84d
Patch
Three critical patches landed today, one hitting a perfect CVSS 10.0: • HashiCorp Terraform MCP Server: CVE-2026-16498 (10.0), cross-tenant token reuse in stateless mode. Fixed 1.1.0/1.2.0. • Veeam Service Provider Console: CVE-2026-58073 (9.5), unauthenticated credential theft. Fixed build 9.3.0.35057. • Django/GeoDjango: CVE-2026-15307, spatial-lookup file write to RCE. Fixed 6.0.8/5.2.17. No public PoC on any of the three yet. Patch anyway.
Post summary
The text announces three high‑severity patches with detailed vulnerability descriptions, but reports no PoC, exploit code, or active exploitation.
10000107
596 followersView on X
Upwind Security MDR@UpwindMDR92d
Disclosure
🚨Critical - terraform-mcp-server Cross-Tenant Terraform Token Reuse (CVE-2026-16498) In terraform-mcp-server, the streamable-HTTP stateless transport mode can leak/reuse the prior session’s Terraform token across tenants. An attacker can replay a token from one user to execute subsequent tool calls as another user, leading to full cross-tenant compromise. Stateful/non-stateless transports are not impacted. 👉Affected: terraform-mcp-server < 1.1.0 | Upgrade to 1.1.0
Post summary
CVE-2026-16498 allows cross‑tenant token reuse in the stateless mode of terraform‑mcp‑server, enabling full compromise of other users; upgrading to version 1.1.0 resolves the issue.
0001083
274 followersView on X
IntegSec@integ_sec36d
Disclosure
CVE-2026-16498: HashiCorp Terraform MCP Server Cross-Tenant Credential Reuse - What It Means for Your Business and How to Respond https://hubs.li/Q04y4sTl0
Post summary
The message discloses CVE-2026-16498 in HashiCorp Terraform MCP Server, describing a cross-tenant credential reuse vulnerability and advising on business impact and response, without referencing PoCs, exploits, patches, or active exploitation.
0000033
35 followersView on X
Fiona@fiona_novesai79d
Patch
CVSS 10.0 in a Terraform MCP server. Not prompt injection. Not jailbreaking. Just session state: stateless HTTP mode reused one user's Terraform token for the next. AI agent security is moving from model tricks to infra bugs. CVE-2026-16498. Patch now.
Post summary
The post announces a CVE-2026-16498 vulnerability with a CVSS score of 10.0 affecting Terraform MCP servers and notes that a patch has been released.
0000062
15 followersView on X
Robert Clapp@RobertClapp84d
Disclosure
@SecPod CVE-2026-16498 reusing one user's terraform token for another is exactly the class of bug that shows up when you treat scope isolation as optional. just went through this with darkcontext, an empty env var bypassed the scope filter and would have dumped the entire memory store. pinned every github action to full commit SHA after zizmor flagged the job holding NPM_TOKEN. mutable tags in CI are the same category of trust assumption.
Post summary
The message highlights the discovery of CVE‑2026‑16498, details how it allows token reuse via an empty env var, and suggests mitigation by pinning GitHub Actions to specific commits, but provides no PoC, exploit, or evidence of active exploitation.
0000044
112 followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-16498 The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow on… https://www.cve.org/CVERecord?id=CVE-2026-16498 ----- Traducción: CVE-2026-16498 El … http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑16498, briefly describing a cross‑tenant credential reuse flaw in terraform‑mcp‑server, with a link to the official CVE record.
0000038
95 followersView on X
CVE@CVEnew92d
General
CVE-2026-16498 The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow on… https://www.cve.org/CVERecord?id=CVE-2026-16498
Post summary
The text briefly notes a credential reuse vulnerability in terraform‑mcp‑server before 1.1.0, without details on exploitation, tooling, or remediation.
00000584
57.9K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-16498

ɐpnH[verified]@AlAssaf_HPatch

The post describes a critical Terraform MCP Server vulnerability (CVE‑2026‑16498) with a CVSS score of 10.0, highlighting token theft and cross‑tenant reuse, and urges updating to version 1.1.0.

yousukezan[verified]@yousukezanPatch

HashiCorp released patch 1.1.0 for three critical vulnerabilities in Terraform MCP Server, detailing token leakage and SSRF risks, with no active exploitation reported.

ボス@サイバーセキュリティの専門家[verified]@boss_sec_laboActive Exploitation

The message lists four CVEs with high CVSS, notes active exploitation by ransomware and notifications from Mandiant, and urges immediate patch verification.

Xavier Rivera[verified]@XavierRiveraXPatch

The text announces three high‑severity patches with detailed vulnerability descriptions, but reports no PoC, exploit code, or active exploitation.

Upwind Security MDR[verified]@UpwindMDRDisclosure

CVE-2026-16498 allows cross‑tenant token reuse in the stateless mode of terraform‑mcp‑server, enabling full compromise of other users; upgrading to version 1.1.0 resolves the issue.

IntegSec[verified]@integ_secDisclosure

The message discloses CVE-2026-16498 in HashiCorp Terraform MCP Server, describing a cross-tenant credential reuse vulnerability and advising on business impact and response, without referencing PoCs, exploits, patches, or active exploitation.

Fiona[verified]@fiona_novesaiPatch

The post announces a CVE-2026-16498 vulnerability with a CVSS score of 10.0 affecting Terraform MCP servers and notes that a patch has been released.

Robert Clapp[verified]@RobertClappDisclosure

The message highlights the discovery of CVE‑2026‑16498, details how it allows token reuse via an empty env var, and suggests mitigation by pinning GitHub Actions to specific commits, but provides no PoC, exploit, or evidence of active exploitation.