Vulnerability intelligence

CVE-2026-16498

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

CVSS Score

Critical

EPSS — Exploit Probability

0.5%

Riskier than 39% of all CVEs · checked 2026-09-16

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Aug 4, 2026 · latest Aug 4, 2026

Coverage timeline

Terraform MCP Server Flaw CVE-2026-16498 Scores CVSS 10.0
securityonline.info · Aug 4, 2026

Related CVEs — HashiCorp

CVE-2026-8715