https://www.cloudkaramchari.com/tags/cve/Recent content in CVE on CloudkaramchariHugo -- gohugo.ioencloudkaramchariSat, 08 Aug 2026 20:00:00 +0530https://www.cloudkaramchari.com/blog/terraform-mcp-server-cvss-10-vulnerabilities-patch-now/Sat, 08 Aug 2026 20:00:00 +0530https://www.cloudkaramchari.com/blog/terraform-mcp-server-cvss-10-vulnerabilities-patch-now/ <h1 id="terraform-mcp-server-had-a-cvss-100-bug-patch-to-120-now">Terraform MCP Server Had a CVSS 10.0 Bug: Patch to 1.2.0 Now</h1> <p>If you've stood up HashiCorp's <code>terraform-mcp-server</code> so an AI agent can query the Terraform Registry or talk to your workspaces, go check its version right now. HashiCorp Security Advisory HCSEC-2026-23, published July 28, 2026, covers three vulnerabilities in the server's streamable-HTTP transport — the worst of them, CVE-2026-16498, is a maximum-severity 10.0 on the CVSS scale. It lets one tenant's requests get serviced with a completely different tenant's Terraform credentials, with no authentication required from the attacker.</p>