Critical severity10.0NVD Advisory· Published Jul 28, 2026· Updated Jul 30, 2026
CVE-2026-16498
CVE-2026-16498
Description
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <1.1.0
Patches
Vulnerability mechanics
References
1News mentions
2- ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router BackdoorsThe Hacker News · Aug 10, 2026
- Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant BugThe Hacker News · Aug 5, 2026