CVE-2026-16498 in terraform-mcp-server
Summary
by MITRE • 07/28/2026
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The terraform-mcp-server vulnerability CVE-2026-16498 represents a critical cross-tenant credential reuse flaw that fundamentally compromises the security boundaries between different users operating within the same system infrastructure. This issue specifically manifests in the streamable-http stateless transport mode, where the server fails to properly isolate authentication contexts between concurrent users. The vulnerability arises from inadequate session management and token validation mechanisms that allow an attacker or malicious user to potentially hijack credentials from one tenant and execute unauthorized operations on behalf of other tenants within the same infrastructure.
The technical flaw stems from improper handling of stateless HTTP requests where Terraform tokens are not adequately scoped or validated against the requesting user context. In the affected versions, when multiple users interact with the server through the streamable-HTTP transport mode, the system fails to maintain proper isolation between authentication states, creating a condition where credentials issued to one user can be reused by subsequent users without proper re-authentication. This represents a classic violation of the principle of least privilege and demonstrates inadequate credential management practices that align with CWE-285 Access Control Issues.
The operational impact of this vulnerability extends beyond simple credential theft, as it enables arbitrary tool execution on behalf of other users, potentially allowing for unauthorized infrastructure changes, data access, or even complete system compromise. Attackers could leverage this flaw to execute Terraform operations with elevated privileges belonging to different tenants, leading to unauthorized resource provisioning, configuration modifications, or data exfiltration across tenant boundaries. This cross-tenant escalation capability significantly amplifies the potential damage and creates a vector for lateral movement within multi-tenant environments where proper isolation is expected.
Mitigation strategies should focus on implementing robust session management protocols that properly isolate authentication contexts between users, ensuring that each HTTP request contains sufficient contextual information to validate the requesting user's identity and authorization level. The fix implemented in terraform-mcp-server version 1.1.0 addresses this issue through enhanced token validation mechanisms and proper state management that prevents credential reuse across different tenant contexts. Organizations should also implement monitoring for unauthorized credential usage patterns and consider implementing additional authentication layers such as multi-factor authentication or just-in-time access provisioning to reduce the attack surface. This vulnerability aligns with ATT&CK technique T1566 Credential Access through improper session handling and represents a significant concern for cloud infrastructure providers who must maintain strict tenant isolation boundaries.