Terraform MCP Server Had a CVSS 10.0 Bug: Patch to 1.2.0 Now

If you've stood up HashiCorp's terraform-mcp-server so an AI agent can query the Terraform Registry or talk to your workspaces, go check its version right now. HashiCorp Security Advisory HCSEC-2026-23, published July 28, 2026, covers three vulnerabilities in the server's streamable-HTTP transport — the worst of them, CVE-2026-16498, is a maximum-severity 10.0 on the CVSS scale. It lets one tenant's requests get serviced with a completely different tenant's Terraform credentials, with no authentication required from the attacker.

This isn't an edge-case config mistake. It's the default failure mode of running an MCP server the way a lot of teams are running MCP servers right now: as a shared HTTP endpoint behind a load balancer, serving multiple users or CI jobs from one process, exactly the deployment shape MCP servers are increasingly used for. If any of that describes your setup, the fix is a version bump, and it's worth doing today.

What actually broke

All three CVEs live in the Streamable HTTP transport mode (the mode you use when the server isn't just talking stdio to a single local client). stdio-only deployments are unaffected by all three.

CVE-2026-16498 — cross-tenant credential reuse (CVSS 10.0), stateless HTTP mode. The stateless transport never assigned unique session identifiers per request. The server used those identifiers to figure out which caller's Terraform token to attach to a tool call — without them, it couldn't tell callers apart. In practice: user A's token gets reused to service user B's tools/call request on the same server instance. No authentication or user interaction needed on the attacker's side — just network access to the listener.

CVE-2026-16496 — authorization bypass (CVSS 8.9), stateful HTTP mode. The stateful transport's per-session client cache keyed cached Terraform clients by MCP session ID alone, without binding that cache entry to the token that originally created it. Anyone who obtains another user's session ID — through logging, a proxy, a referrer leak, anywhere session IDs tend to end up — can have their own tool calls executed with that user's credentials.

CVE-2026-14869 — server-side request forgery (CVSS 8.6). The request middleware validated the TFE_ADDRESS parameter when a client sent it as an HTTP header, but skipped that same validation when the identical value arrived as a query parameter instead. An unauthenticated client could set TFE_ADDRESS to a server it controls and get the Terraform MCP server to send its own bearer token there.

Combined impact per HashiCorp's advisory: an attacker with nothing but network reach to a vulnerable streamable-HTTP instance can read and write Terraform-managed infrastructure state and resources under someone else's identity.

Why this class of bug keeps showing up in MCP servers

MCP servers are a new-ish category, and a lot of them were built with the "one client on my laptop" case first and multi-tenant deployment bolted on later. That ordering is exactly backwards for security: session-scoped identity is easy to get right when there's one caller, and easy to get subtly wrong once you add concurrency. The Terraform MCP server's own GitHub history bears this out — version 1.0.0's changelog literally removed a "local-use-only" warning from the README a few weeks before this advisory shipped. If you're evaluating other MCP servers for production use, "was this designed for multi-tenant HTTP from day one, or did that get added later" is a fair question to ask before you trust it with real credentials.

How to check if you're affected

1# Check the version your server reports
2docker run --rm hashicorp/terraform-mcp-server:latest --version
3# or, if you built/installed it directly:
4terraform-mcp-server --version

Versions 0.2.1 through 1.0.0 are vulnerable. You're at elevated risk specifically if:

• You're running the streamable-HTTP transport (not stdio-only), and
• The server is reachable by more than one user, tenant, or CI job — whether that's a shared internal deployment, a multi-tenant SaaS wrapper, or just a dev server left open on a shared network

Patching

Upgrade to 1.2.0 (released August 4, 2026), which supersedes the initial fix in 1.1.0 (July 14, 2026):

1docker pull hashicorp/terraform-mcp-server:1.2.0

If you manage it via a package or Go install:

1go install github.com/hashicorp/terraform-mcp-server@v1.2.0

After upgrading, rotate every Terraform token that was ever used against a vulnerable instance running in streamable-HTTP mode — patching closes the hole, but it doesn't invalidate credentials that may have already leaked across tenants while it was open. Terraform tokens are rotated the normal way: revoke the old token in Terraform Cloud/Enterprise or via terraform login, issue a new one, and update whatever secret store your MCP deployment reads from.

If you can't patch immediately, HashiCorp's advisory gives an interim mitigation: restrict network access to the streamable-HTTP listener to trusted callers only, and treat MCP session IDs as sensitive values — don't log them, don't put them in URLs, don't forward them through anything that isn't already inside your trust boundary.

Best practices for running MCP servers that touch real credentials

• Default to stdio for single-user, local use. Only turn on streamable-HTTP when you actually need shared/remote access — it's a materially larger attack surface, as this advisory demonstrates.
• Put an authenticating reverse proxy in front of any HTTP-mode MCP server, one that enforces per-caller identity independent of whatever the MCP server itself does with session IDs. Don't let the MCP server's own session handling be your only isolation boundary.
• Never assume "authenticated by network location" is enough. CVE-2026-16498 required zero authentication from the attacker — anyone who could reach the listener could pull it off. A server sitting on a shared VPC or corp network is not a security boundary by itself.
• Pin and track MCP server versions the same way you track base images or providers. These servers are new, actively developed, and — as this advisory shows — carry real risk when they mediate credentials. Subscribe to the specific repo's security advisories, not just a general "AI security" feed.
• Audit what your MCP server's Terraform token can actually do. If the token backing your MCP server has broad workspace access, a credential-confusion bug like this one has a much bigger blast radius than if it's scoped tightly.

Common mistakes to avoid

• Patching the server but skipping token rotation. The version bump stops new exploitation; it does nothing about credentials that already crossed tenant boundaries before you patched.
• Assuming stdio mode makes you exempt from the whole advisory, then later switching to HTTP mode without re-reading it. All three CVEs are transport-specific — re-evaluate whenever you change how the server is exposed.
• Treating this as a "someone else's problem" advisory because it's not in your cloud provider's own changelog. MCP servers sit in the same trust path as your cloud credentials even though HashiCorp, not AWS or Azure, ships the patch.
• Only checking the HTTP header for TFE_ADDRESS overrides in your own middleware, if you've built anything similar. CVE-2026-14869 exists specifically because header validation and query-parameter validation diverged — a reminder to validate a value the same way regardless of where in the request it travels.

Troubleshooting

I upgraded but I'm not sure my deployment actually restarted on the new image. Check the version endpoint or --version output directly against the running container/process — don't trust a docker-compose up -d exit code alone; confirm the digest or tag actually changed on the running instance.

I can't tell if I was ever running the vulnerable stateless mode. Check whatever flag or environment variable your deployment sets for transport mode (this varies by how you invoke the server — check your startup command or Helm values/compose file for anything mentioning stateless or http). If you can't determine it with confidence, treat token rotation as mandatory rather than optional.

Rotating the Terraform token broke other integrations. That token is likely shared across more than the MCP server. This is itself worth fixing separately — a credential shared across multiple systems means any one compromise (or, as here, any transport bug) forces you to rotate everywhere at once. Scope tokens per-consumer going forward.

FAQ

Am I affected if I only ever run the Terraform MCP server locally via stdio? No. All three CVEs are specific to the streamable-HTTP transport. stdio-only deployments are explicitly called out as unaffected in the advisory.

Do I need to rotate tokens if I was on stateful HTTP mode but only ever had one user? The bugs require another tenant's request to actually hit the shared cache or session, so a genuinely single-user deployment has a much smaller practical exposure window — but if the server was ever reachable by more than the one user you intended (a misconfigured network rule, a forgotten firewall exception), rotate anyway. You can't retroactively prove no one else connected.

Is this an MCP protocol flaw, or specific to HashiCorp's implementation? It's implementation-specific to terraform-mcp-server. MCP's stateless-first direction (see the July 2026 protocol revision) actually removes the concept of a long-lived session ID entirely going forward, which is a different and unrelated change — worth knowing about separately if you're building or running MCP servers.

What CVSS score triggers "patch immediately" versus "patch on the next cycle" for something like this? There's no universal number, but 10.0 with no authentication required and confirmed cross-tenant credential exposure is about as unambiguous as advisories get. Treat it the way you'd treat any unauthenticated remote credential-disclosure bug in production infrastructure tooling — same day, not next sprint.

Key takeaways

Further Reading

• MCP Goes Stateless on July 28, 2026: What Breaks and How to Migrate Your Server
• Amazon Bedrock AgentCore Runtime: Stateful MCP Revolutionizing AI in 2026
• GitHub Actions Checkout v7: Fixing the Pwn Request Vulnerability Before July 16
• HCSEC-2026-23 Advisory (official, HashiCorp Discuss)
• terraform-mcp-server releases (official, GitHub)