CVE-2026-16498: Cross-tenant Credential Reuse in HashiCorp
TL;DR - Critical flaw in terraform-mcp-server can reuse one user’s Terraform token for later users. - Affects versions 0.2.1 through 1.0.0 in streamable-HTTP stateless transport mode. - Upgrade to 1.1.0 immediately; no CISA-confirmed exploitation is known yet.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-16498 |
| CVSS score | 10.0 |
| Attack vector | Not disclosed in the source material beyond occurring in streamable-HTTP stateless transport mode |
| Auth required | Unknown from published source excerpts; defenders should assume an authenticated or multi-user service context is enough to create risk |
| Patch available | Yes, fixed in terraform-mcp-server 1.1.0 |
CVE-2026-16498 is a critical vulnerability in HashiCorp terraform-mcp-server caused by cross-tenant credential reuse. According to the NVD description and HashiCorp’s bulletin, the issue affects the product’s streamable-HTTP stateless transport mode and may allow one user’s Terraform token to be used for subsequent users’ tool calls.
The practical risk is an authorization boundary failure. In a multi-user deployment, requests handled after an earlier authenticated session may inherit that prior user’s Terraform token. For defenders, that means the impact is not just token exposure in the abstract. It can translate into actual tool execution, workspace operations, and actions carried out under the wrong identity.
What Is This Vulnerability?
At its core, this is a credential isolation failure. The vulnerable service appears to mishandle token lifecycle or request scoping in a way that breaks tenant or user separation. HashiCorp describes it as a “cross-tenant credential reuse issue” in streamable-HTTP stateless transport mode, with the result that one user’s Terraform token may be used to execute tool calls on behalf of subsequent users.
That wording matters because it points to more than a simple session mix-up. In a system expected to behave statelessly, credentials should be bound to the current request context and discarded cleanly once processing ends. If the implementation reuses cached state, a shared client, or improperly scoped authorization context, later requests may execute with stale credentials. In a multi-tenant or shared internal deployment, that breaks a fundamental security assumption: one user’s identity must never leak into another user’s operation path.
A second concern is the type of token involved. Terraform tokens often provide access to Terraform Cloud, HCP Terraform, workspace automation, or related infrastructure actions. Even when the product itself is not internet-facing, a token reuse flaw can still be severe because the compromised boundary is identity enforcement, not just local data exposure. If the wrong token is applied to a request, downstream infrastructure changes may be authorized incorrectly.
Technical Notes
The vendor and NVD descriptions do not provide implementation-level root cause details such as specific code paths, classes, or variables. In the absence of a published patch diff analysis, practitioners should treat this as an authorization context contamination issue in the HTTP transport layer rather than assume a narrower edge case.
Vendor description:
"may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users"
Who Is Affected?
The confirmed affected product is HashiCorp terraform-mcp-server. The affected versions are explicitly listed by HashiCorp as 0.2.1 up to and including 1.0.0. The vulnerability is fixed in 1.1.0.
This means organizations running any release from 0.2.1 through 1.0.0 should consider themselves exposed if they use the vulnerable transport mode. The published description specifically names streamable-HTTP stateless transport mode. If your deployment does not use that mode, the exact exposure may differ, but the safest operational assumption is that any deployment on the affected versions requires validation and likely upgrade.
The most at-risk environments are shared services where multiple users, teams, tenants, or automation clients connect to the same terraform-mcp-server instance. That includes internal platform engineering setups, AI-assisted infrastructure workflows, and central MCP-based services exposed to multiple operators. The security boundary that fails here is per-user token isolation, so single-user lab deployments may carry less real-world risk than shared production instances, but they should still be upgraded.
If you do not know which transport mode is enabled, treat the system as potentially affected until you verify configuration. Unknown deployment details should not delay remediation because the fix is available and the severity is critical.
Technical Notes
Look for deployment artifacts, startup flags, service definitions, or documentation references indicating streamable-HTTP stateless mode in use.
# Example checks for version and deployment context
terraform-mcp-server --version
# If run from a container
docker ps --format "table {{.Names}} {{.Image}}"
docker inspect <container_name> | grep -i -E "stream|http|transport"
# If managed by systemd
systemctl cat terraform-mcp-server
journalctl -u terraform-mcp-server --since "7 days ago"
CVSS Score Breakdown
The NVD lists CVE-2026-16498 with a CVSS base score of 10.0, which is the maximum severity. However, the source data available here does not include the full CVSS vector string. That means it would be inaccurate to assert specific component values such as Attack Complexity, Privileges Required, User Interaction, or Scope without checking the live NVD vector directly.
Even without the vector string, a 10.0 score indicates the issue is considered extremely serious. That aligns with the published behavior: cross-tenant credential reuse can allow unauthorized tool calls under another user’s identity. When identity boundaries break in infrastructure tooling, the downstream blast radius can include configuration changes, workspace actions, and access to sensitive infrastructure metadata.
For practitioners, the absence of the vector string should not reduce urgency. A critical score paired with a vendor patch and explicit affected version range is enough to justify immediate remediation. If your vulnerability management process requires vector-level scoring for prioritization, pull the live NVD record or API response directly before final internal risk scoring, but do not delay the upgrade while waiting for that enrichment.
Technical Notes
Fields confirmed from the source material:
CVE: CVE-2026-16498
CVSS base score: 10.0
CVSS vector: not exposed in the source material provided here
Fixed version: 1.1.0
Exploitation Status
As of 2026-07-28, there is no CISA-confirmed exploitation in the wild for CVE-2026-16498. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog based on the provided research note. That means defenders cannot cite KEV as evidence of active exploitation at this time.
There is also no public proof-of-concept confirmed in the gathered source set. That is an important distinction. “No public PoC found” does not mean the flaw is difficult to exploit, and “not on KEV” does not mean it is safe to defer. Credential isolation flaws are often straightforward to weaponize once researchers or attackers understand the vulnerable request flow, especially in products used for automation and infrastructure access.
The safest language for incident response and patching teams is: critical vulnerability, patch available, no confirmed in-the-wild exploitation from CISA, and no public PoC confirmed in the source set. If your organization exposes the service to multiple users or connects it to sensitive Terraform environments, prioritize as though exploitation could emerge quickly after disclosure.
Technical Notes
Operational status summary:
CISA KEV listed: No
Public PoC confirmed in source set: No
Vendor fix available: Yes, 1.1.0
Recommended defender assumption: High risk in multi-user deployments despite no confirmed exploitation
Additional Resources
For further information on related security practices, you may find the following articles useful: - What is DDoS? - How to Protect Your Laptop While Traveling
How to Detect It
Detection is challenging because this flaw is about the wrong token being applied to a valid request, not necessarily a malformed exploit payload. In practice, the best indicators are mismatches between the authenticated caller and the identity that downstream Terraform or HCP Terraform logs show as executing actions. Defenders should look for user A making a request followed by user B receiving results, permissions, or actions consistent with user A’s token.
Start by reviewing terraform-mcp-server access logs, reverse proxy logs, and any downstream Terraform platform audit logs. Focus on sequences where multiple users interact with the same server instance in close succession. If the same bearer token fingerprint, API token identifier, or authorization subject appears across distinct users or sessions, that is a strong lead. Also investigate unexpected cross-workspace actions or tools succeeding for a user who should not have had access.
Because no vendor-published detection guidance or canonical log schema is available in the source material, defenders should build correlation around shared service instances. Tie together incoming request identity, source IP, session headers if present, and the downstream token or principal used for Terraform operations.
Technical Notes
Example log hunting patterns and correlation ideas:
# Search service logs for authorization headers, token reuse clues, or repeated principals
journalctl -u terraform-mcp-server --since "24 hours ago" |
grep -Ei "authorization|bearer|token|workspace|tool call|user|principal"
# Search reverse proxy logs for the same client endpoint servicing multiple users rapidly
grep -Ei "terraform-mcp-server|/mcp|/tools|/stream" /var/log/nginx/access.log
Example suspicious pattern to investigate:
[timestamp] user=alice request_id=abc123 tool=list_workspaces status=200
[timestamp] user=bob request_id=def456 tool=apply_workspace status=200 principal=alice-token
Example Splunk-style query for shared-instance anomalies:
index=app_logs service="terraform-mcp-server"
| rex field=_raw "user=(?<user>[A-Za-z0-9._-]+)"
| rex field=_raw "principal=(?<principal>[A-Za-z0-9._:-]+)"
| stats values(user) as users values(principal) as principals count by host
| where mvcount(users) > 1 AND mvcount(principals) >= 1
If you lack token-level telemetry, use downstream audit logs from Terraform or HCP Terraform to identify actions attributed to one token immediately after requests from a different interactive user. That kind of temporal mismatch is often the most practical detection route for identity reuse flaws.
Mitigation and Patching
The definitive fix is to upgrade HashiCorp terraform-mcp-server to version 1.1.0 or later. The vulnerable range is 0.2.1 through 1.0.0, and both NVD and HashiCorp state the flaw is fixed in 1.1.0. For most organizations, patching should be treated as the primary mitigation rather than relying on compensating controls.
If you cannot upgrade immediately, reduce exposure by limiting the server to single-user or tightly segmented use where feasible, and avoid shared multi-tenant access paths. Because the issue specifically involves streamable-HTTP stateless transport mode, review whether that mode can be disabled or isolated until the upgrade is complete. The source material does not provide an official vendor workaround beyond applying the fixed version, so any temporary controls should be treated as risk reduction, not a complete fix.
You should also rotate Terraform tokens that may have been exposed to unintended reuse, especially in environments where multiple users shared one vulnerable server instance. While the published description does not explicitly say tokens are disclosed, it does say they may be reused to execute tool calls for subsequent users. That is enough to justify token hygiene after patching, particularly for privileged service accounts or tokens tied to production workspaces.
Technical Notes
Upgrade to the fixed release:
# Verify current version
terraform-mcp-server --version
# If installed from source or binary release, replace with 1.1.0 or later
# Example pattern:
curl -L -o terraform-mcp-server https://github.com/hashicorp/terraform-mcp-server/releases/download/v1.1.0/terraform-mcp-server_linux_amd64
chmod +x terraform-mcp-server
sudo mv terraform-mcp-server /usr/local/bin/terraform-mcp-server
# Restart service
sudo systemctl restart terraform-mcp-server
If running in a containerized deployment:
# Pull fixed image or rebuild using v1.1.0 source
docker pull <your-registry>/terraform-mcp-server:1.1.0
docker stop terraform-mcp-server
docker rm terraform-mcp-server
docker run -d --name terraform-mcp-server <your-registry>/terraform-mcp-server:1.1.0
Temporary risk-reduction steps if upgrade must wait:
- Remove or restrict shared multi-user access to vulnerable instances
- Disable or isolate streamable-HTTP stateless transport mode if your deployment supports it
- Rotate Terraform tokens after patching
- Review downstream Terraform audit logs for cross-user activity
Because deployment methods vary and the vendor advisory in the provided sources does not specify package-manager commands, administrators should adapt the upgrade process to their installation method while ensuring the target version is 1.1.0 or later.
References
The primary source for the CVE description is the National Vulnerability Database entry for CVE-2026-16498. That entry states the flaw affects terraform-mcp-server before version 1.1.0 and describes the issue as cross-tenant credential reuse in streamable-HTTP stateless transport mode.
The vendor source is HashiCorp security bulletin HCSEC-2026-23, which confirms the affected range as 0.2.1 through 1.0.0 and the fixed version as 1.1.0. Additional project references include the official GitHub repository, releases page, and changelog location for release validation.
- NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-16498
- HashiCorp security bulletin HCSEC-2026-23: https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606
- HashiCorp terraform-mcp-server repository: https://github.com/hashicorp/terraform-mcp-server
- Releases: https://github.com/hashicorp/terraform-mcp-server/releases
- Changelog: https://github.com/hashicorp/terraform-mcp-server/blob/main/CHANGELOG.md
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.