What happened
HashiCorp disclosed (2026-07-28) that terraform-mcp-server before 1.1.0 fails to properly isolate per-request identity in streamable-HTTP stateless mode, allowing one user's Terraform token to be reused for another user's tool calls. This is one of three related vulnerabilities (CVE-2026-16498, CVE-2026-16496, CVE-2026-14869) disclosed in the same bulletin.
Why it matters
MCP servers are increasingly deployed as shared multi-tenant AI-agent gateways to infrastructure tooling; a credential-reuse flaw in a widely-used official MCP server for Terraform means an AI agent acting on behalf of one tenant could silently execute privileged infrastructure operations using another tenant's credentials — a direct blast-radius amplifier for agentic DevOps pipelines.
Attack vector
In streamable-HTTP stateless transport mode, one user's Terraform API token can be reused to execute tool calls on behalf of a subsequent, different user — allowing cross-tenant credential theft/reuse without direct exploitation steps beyond normal API use of a shared stateless endpoint.
Affected systems
hashicorp/terraform-mcp-server 0.2.1 up to and including 1.0.0
Mitigation
Upgrade to terraform-mcp-server 1.1.0. See HashiCorp Security Bulletin HCSEC-2026-23.