CVE-2026-1649810.0CriticalCWE-488
CVE-2026-16498: terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
HashiCorp · Tooling
Fixed in 1.1.0 · Affected: HashiCorp Tooling before 1.1.0 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.5%probability of exploitation in the next 30 days
39th percentile
050100
Higher than 39% of scored CVEs
10.0CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 4 Aug.
- Terraform MCP Server Flaw CVE-2026-16498 Scores CVSS 10.0SecurityOnline · first in our coverage
New articles also arrive in the RSS feed.