CVE-2026-14869: Terraform MCP Server SSRF Vulnerability

CVE-2026-14869 Overview

CVE-2026-14869 is a server-side request forgery (SSRF) vulnerability in HashiCorp's terraform-mcp-server before version 1.1.0. The flaw exists in the streamable-HTTP transport and allows an unauthenticated remote client to redirect the server's outbound Terraform API requests to an attacker-controlled endpoint. When redirected, the server also forwards its authorization token, exposing credentials to the attacker. HashiCorp addressed the issue in terraform-mcp-server 1.1.0.

Critical Impact
An unauthenticated network attacker can coerce the server into leaking its Terraform API authorization token to an attacker-controlled destination, enabling downstream access to Terraform resources.

Affected Products

HashiCorp terraform-mcp-server versions prior to 1.1.0
Deployments exposing the streamable-HTTP transport
Environments where the server holds a Terraform API authorization token

Discovery Timeline

2026-07-28 - CVE-2026-14869 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14869

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) issue [CWE-918] in the streamable-HTTP transport of terraform-mcp-server. The Model Context Protocol (MCP) server acts as an intermediary between clients and the Terraform API. Insufficient validation of destination endpoints in the streamable-HTTP transport allows a remote client to influence where the server sends outbound API requests. Because the server attaches its authorization token to those outbound calls, redirection to an attacker-controlled host results in credential disclosure. Attack complexity is low and no authentication or user interaction is required, and the scope is changed since the impact reaches beyond the vulnerable component to the Terraform backend.

Root Cause

The root cause is missing or inadequate validation of the request target within the streamable-HTTP transport. The server trusts client-supplied routing information when constructing outbound Terraform API requests. This trust allows an external actor to substitute a legitimate Terraform endpoint with a malicious URL controlled by the attacker.

Attack Vector

An unauthenticated attacker sends crafted requests over the network to the exposed streamable-HTTP transport. The request manipulates the destination of the server's proxied Terraform API call. The server then issues an outbound HTTP request to the attacker-controlled endpoint and includes the server-side authorization token in the request headers. The attacker captures the token and reuses it to authenticate against the legitimate Terraform API. Refer to the HashiCorp Security Advisory HCSEC-2026-23 for vendor-provided technical detail.

Detection Methods for CVE-2026-14869

Indicators of Compromise

Outbound HTTPS connections from terraform-mcp-server hosts to domains that do not belong to the configured Terraform API endpoints
Authorization headers or bearer tokens observed in traffic sent to unexpected destinations
Unusual client requests to the streamable-HTTP transport that include external URLs or host overrides

Detection Strategies

Baseline the set of legitimate destinations the MCP server contacts and alert on deviations
Inspect proxy and egress firewall logs for terraform-mcp-server outbound requests carrying authorization tokens to non-HashiCorp domains
Correlate inbound requests on the streamable-HTTP transport with subsequent outbound requests to detect redirection patterns

Monitoring Recommendations

Log all inbound requests to the streamable-HTTP transport, including full URL parameters and headers
Monitor Terraform Cloud or Terraform Enterprise audit logs for API calls originating from unexpected IP addresses following token exposure
Alert on any use of the server's authorization token from source IPs outside the approved infrastructure range

How to Mitigate CVE-2026-14869

Immediate Actions Required

Upgrade terraform-mcp-server to version 1.1.0 or later on all deployments
Rotate any Terraform API authorization tokens that were configured on affected servers, since exposure cannot be ruled out
Restrict network exposure of the streamable-HTTP transport to trusted clients only

Patch Information

HashiCorp fixed CVE-2026-14869 in terraform-mcp-server 1.1.0. Details are documented in HashiCorp Security Advisory HCSEC-2026-23. Operators should upgrade prior to reintroducing tokens with elevated Terraform privileges.

Workarounds

Disable the streamable-HTTP transport if it is not required for operational use
Enforce egress filtering so the server can only reach approved Terraform API hostnames
Place the MCP server behind an authenticating reverse proxy that terminates untrusted client connections

bash

# Configuration example: restrict egress to approved Terraform endpoints
# (adjust for your environment; example uses iptables OUTPUT filtering)
iptables -A OUTPUT -p tcp -d app.terraform.io --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT