Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-16498— terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

CVSS 10.0 · Critical EPSS 0.33% · P26

Possible ATT&CK Techniques 1AI

T1078 · Valid Accounts

Affected Version Matrix 1

VendorProductVersion RangeStatus
HashiCorpTooling0.3.0< 1.1.0affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-16498

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
Source: CVE Program / CVE List V5
Vulnerability Description
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对错误会话暴露数据元素
Source: CVE Program / CVE List V5
Vulnerability Title
HashiCorp Tooling 会话机制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HashiCorp Tooling是美国HashiCorp公司的系统工具组件。 HashiCorp Tooling 1.1.0之前版本存在会话机制问题漏洞，该漏洞源于streamable-HTTP stateless传输模式下的跨租户凭证重用问题，可能导致一个用户的Terraform token被用于代表后续用户执行工具调用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
HashiCorpTooling 0.3.0 ~ 1.1.0 -

II. Public POCs for CVE-2026-16498

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-16498

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-16498 (1)

Same Patch Batch · HashiCorp · 2026-07-28 · 3 CVEs total

CVE-2026-164968.9 HIGHterraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID
CVE-2026-148698.6 HIGHterraform-mcp-server vulnerable to server side request forgery leading to token exposure

IV. Related Vulnerabilities

Same product: Tooling
Same vendor: HashiCorp
Same weakness: CWE-488

V. Comments for CVE-2026-16498

No comments yet

Leave a comment