terraform-mcp-server vulnerabilities
3 known CVE vulnerabilities in terraform-mcp-server, translated and rated.
- CVE-2026-16498Critical
Terraform-mcp-server before version 1.1.0 is vulnerable to cross-tenant credential reuse in streamable-HTTP mode, allowing one user's Terraform token to be used for tool calls on behalf of other users.
- CVE-2026-16496High
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials.
- CVE-2026-14869High
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests and the server-side authorization token to an attacker-controlled endpoint.