What is GHSA-rhh5-3xrh-6535?

GHSA-rhh5-3xrh-6535 is a security advisory published by GitHub Security Advisories with High severity. The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery...

Which CVE IDs does GHSA-rhh5-3xrh-6535 cover?

GHSA-rhh5-3xrh-6535 covers the following CVE IDs: CVE-2026-14869. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rhh5-3xrh-6535?

GHSA-rhh5-3xrh-6535 has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

GHSA-rhh5-3xrh-6535HighCVSS 8.6

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery...

Vendor

GitHub Security Advisories

Published

July 28, 2026

Last Modified

July 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-14869 →

📋 Description

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-14869
https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606
https://github.com/advisories/GHSA-rhh5-3xrh-6535