HCSEC-2026-23 - Multiple vulnerabilities impacting HashiCorp Terraform MCP Server

Bulletin ID: HCSEC-2026-23 Affected Products / Versions: terraform-mcp-server 0.2.1 up to and including 1.0.0; fixed in 1.1.0. Publication Date: July 28, 2026 Summary The terraform-mcp-server before version 1.1.0 is vulnerable to three related issues in its streamable-HTTP transport: a server-side request forgery issue that may allow an unauthenticated client to redirect the server’s bearer token to an attacker-controlled endpoint (CVE-2026-14869), an authorization bypass in stateful mode that may allow an authenticated user to access another user’s cached Terraform credentials (CVE-2026-16496), and a cross-tenant credential reuse issue in stateless mode that may allow one user’s Terraform token to be used for subsequent users’ requests (CVE-2026-16498). All three vulnerabilities are fixed in terraform-mcp-server 1.1.0. Background The terraform-mcp-server supports a streamable-HTTP transport mode for centralized, multi-user deployments in which each user supplies their own Terraform Cloud or Enterprise token per request for RBAC enforcement. In this mode the server can operate statelessly, where each request is handled independently, or statefully, where it maintains a per-session Terraform API client cache to avoid reconstructing a client on every tool call. The server also accepts configuration for the Terraform endpoint address and authenticates to that endpoint using a server-side bearer token. Details CVE-2026-14869: Server-side request forgery via client-supplied Terraform address The middleware that processed incoming HTTP requests rejected a client-supplied Terraform address when it was provided as an HTTP header, but did not apply the same check when the same value was supplied as an HTTP query parameter. An unauthenticated remote client could include the Terraform address as a query parameter, causing the server to pair the attacker-supplied address with its configured bearer token and transmit that token to the attacker-controlled endpoint. Exploi…