High severity8.9NVD Advisory· Published Jul 28, 2026· Updated Jul 30, 2026
CVE-2026-16496
CVE-2026-16496
Description
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability, CVE-2026-16496, is fixed in terraform-mcp-server 1.1.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <1.1.0
Patches
Vulnerability mechanics
References
1News mentions
2- ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router BackdoorsThe Hacker News · Aug 10, 2026
- Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant BugThe Hacker News · Aug 5, 2026