HashiCorp Terraform MCP Server: Three High-Severity Flaws, CVE-2026-16498 Scores 10.0 for Cross-Tenant Terraform Token Abuse

HashiCorp released Terraform MCP Server 1.1.0, patching three high-severity bugs in multi-tenant mode: cross-tenant Terraform token reuse CVE-2026-16498 (CVSS 10.0), session-cache reuse 8.9, and SSRF 8.6. Deployments on 1.0.0 and earlier should upgrade immediately.

On August 5, 2026, HashiCorp shipped a Terraform MCP Server 1.1.0 security advisory that patches three high-severity bugs in streamable-HTTP multi-tenant transport. The core issue is CVE-2026-16498, CVSS v3.1 10.0: in stateless mode the server did not isolate sessions. One tenant's Terraform token could be reused on another tenant's request. An attacker could take over cloud infrastructure. HashiCorp confirmed its internal security team found the issues. No in-the-wild exploitation is known. Upgrade promptly.

Incident Overview

Terraform MCP Server is HashiCorp's official MCP (Model Context Protocol) server. It connects AI agents to live Terraform Cloud / Enterprise tool calls. Versions before 1.1.0 offered three transports: stdio (single-user local), streamable-HTTP (multi-user centralized), and pluggable implementations. streamable-HTTP is the default for centralized multi-user deployments. Large enterprises, MSPs, and platform teams use it widely. All three bugs trigger in that mode.

The three CVEs are independent but share a root. On the concurrent multi-tenant request path, the server did not strictly check tenant ownership of sessions, caches, and target addresses. MCP tools drive cloud infrastructure. Any one of these bugs can become a cloud-account-level pivot.

Technical Details

CVE-2026-16498: CVSS 10.0 Cross-Tenant Terraform Token Reuse

• Trigger: streamable-HTTP mode, multiple tenants share one MCP Server instance, server configured stateless;
• Root cause: request handling did not bind tenant identity to the issued Terraform Token. During tenant A's request, tenant B's token could be decoded and injected into the Terraform call chain;
• Impact: the victim's Terraform Token is consumed without their knowledge. An attacker can run `terraform plan`, `terraform apply`, State upload / pull, and fully control the victim tenant's cloud infrastructure;
• Risk: MCP clients are typically bound to user identity via OAuth. Token reuse looks like a normal request chain. Audit and alerting are easily bypassed.

CVE-2026-16496: CVSS 8.9 Stateful Mode Session Cache Reuse

• Trigger: streamable-HTTP + default stateful mode;
• Root cause: the server keyed the client cache on session ID only. It did not bind that key to tenant context;
• Exploit: after stealing a session ID (cross-request session hijack), the attacker impersonates the victim, reads the victim tenant's Terraform access-token cache entry, and reuses it.

CVE-2026-14869: CVSS 8.6 Unauthorized SSRF

• Trigger: streamable-HTTP mode, server connects to a Terraform address supplied by the client;
• Root cause: when the client passed a target Terraform address in the request body, the server validated host / port but ignored the URL query string and full path. An attacker can use the query string to make the server deliver its internal Bearer Token to an arbitrary endpoint;
• Impact: the official HashiCorp server relays the victim tenant's Cloud Token for the attacker. IP allowlists and zero-trust network segmentation are bypassed.

Impact Assessment

These bugs sit in the bridge where AI agents invoke real cloud tools. MCP lets large models operate infrastructure directly. If the MCP Server falls, attackers do not need to hit cloud-vendor IAM. They can create, delete, and exfiltrate resources in the victim tenant's cloud account. The three CVE ratings describe one risk shape: tenant isolation failure. In enterprises with many teams, business lines, and cloud accounts, this centralized MCP gateway is a target for ransomware groups and nation-state APT.

HashiCorp and several research orgs note that MCP streamable-HTTP is a new infrastructure component. Unlike traditional API gateways, few mature security products audit it. Treat it as a core IaC platform entry point.

Remediation

• Upgrade immediately to Terraform MCP Server 1.1.0. Covers all old versions from 0.2.1 through 1.0.0;
• Before upgrade, tighten streamable-HTTP listener access control. Limit to trusted internal segments and mTLS clients. Use short-lived tokens;
• Treat MCP session IDs as secrets. Do not write them to logs, Prometheus scrapes, or SIEM forwarders;
• Put a dedicated audit proxy between MCP Server and Terraform Cloud / Enterprise. Log tenant ID, token fingerprint, and target workspace for every `terraform plan/apply`;
• Force all Terraform calls triggered via MCP into an approval flow (especially `apply`, `destroy`, State upload). Token compromise must not equal production change;
• For every environment still on 0.x / 1.0.x Terraform MCP Server, reissue Terraform Cloud / Enterprise API Tokens and rotate related OAuth Clients;
• Track upstream: HashiCorp security advisories (https://hashicorp.com/security) and Terraform MCP Server Release Notes. Watch for further 1.1.0+ security fixes.

References

• HashiCorp advisory: Terraform MCP Server 1.1.0 Security Advisory
• DBAppSecurity Chinese translation: HashiCorp Terraform MCP Server discloses a critical vulnerability, CVSS 10.0
• Enigma Daily Threat Intelligence Digest (8-05): Daily Threat Intelligence Digest August 5, 2026
• CVE Program Record: CVE-2026-16498, CVE-2026-16496, CVE-2026-14869