What happened
HashiCorp disclosed on 2026-07-28 a companion pair of vulnerabilities to CVE-2026-16498: an authorization bypass via session-ID hijacking (CVE-2026-16496, CVSS 8.9) and an unauthenticated SSRF that exfiltrates the server's Terraform auth token to an attacker-controlled endpoint (CVE-2026-14869, CVSS 8.6).
Why it matters
Together these three terraform-mcp-server flaws mean an attacker with network access to a shared MCP endpoint can hijack sessions, steal credentials via SSRF, or reuse stale tokens — a complete compromise path for AI-agent-driven infrastructure automation using real cloud credentials.
Attack vector
An attacker who obtains another user's MCP session ID can have their own tool calls executed using that victim's Terraform credentials (authorization bypass); separately, an unauthenticated remote client can trigger SSRF that redirects the server's Terraform API requests and bearer token to an attacker-controlled endpoint.
Affected systems
hashicorp/terraform-mcp-server 0.2.1 up to and including 1.0.0
Mitigation
Upgrade to terraform-mcp-server 1.1.0. See HashiCorp Security Bulletin HCSEC-2026-23.