CVE-2026-16498: Terraform MCP Server Auth Bypass Flaw

CVE-2026-16498 Overview

CVE-2026-16498 is a cross-tenant credential reuse vulnerability in HashiCorp terraform-mcp-server versions before 1.1.0. The flaw exists in the streamable-HTTP stateless transport mode. One user's Terraform token can be reused to execute tool calls on behalf of subsequent users of the same server instance. The issue is tracked as [CWE-488: Exposure of Data Element to Wrong Session] and is fixed in terraform-mcp-server 1.1.0. HashiCorp published details in HashiCorp Security Advisory HCSEC-2026-23.

Critical Impact
An attacker can operate against Terraform infrastructure using another tenant's credentials, resulting in unauthorized read and write access to managed resources.

Affected Products

HashiCorp terraform-mcp-server versions prior to 1.1.0
Deployments configured with streamable-HTTP stateless transport mode
Multi-tenant or shared-instance MCP server hosting environments

Discovery Timeline

2026-07-28 - CVE-2026-16498 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-16498

Vulnerability Analysis

The terraform-mcp-server implements a Model Context Protocol (MCP) server that exposes Terraform tooling to AI clients. When run in streamable-HTTP stateless transport mode, the server accepts short-lived HTTP requests without preserving per-session state on the server. Credentials passed with a request are meant to scope tool calls to the requesting caller only.

The vulnerability stems from improper isolation of authentication state across requests in this stateless mode. A Terraform token supplied by one caller persists in a shared execution context. Subsequent tool calls from other callers can execute against the previously supplied credential rather than the credential associated with the new request.

The result is a full break of tenant isolation. An attacker sharing an MCP server instance with a legitimate user can trigger tool calls that Terraform authenticates as the victim.

Root Cause

The root cause maps to [CWE-488]. The stateless transport handler retains or reuses authentication material outside the scope of a single request-response pair. Credentials are not bound to a per-request identity boundary, allowing cross-request and cross-tenant leakage of authorization.

Attack Vector

Exploitation requires network access to a terraform-mcp-server instance running in the vulnerable transport mode. The attacker does not need prior authentication or user interaction. After a legitimate user's request supplies a Terraform token, the attacker issues a follow-up tool call. The server executes that call using the victim's token, granting the attacker the victim's Terraform permissions across workspaces, state, and providers.

No proof-of-concept exploit code is publicly available. Refer to the HashiCorp Security Advisory HCSEC-2026-23 for vendor technical detail.

Detection Methods for CVE-2026-16498

Indicators of Compromise

Terraform Cloud or Terraform Enterprise audit log entries showing tool calls from an MCP server IP that do not correlate to legitimate user sessions.
HTTP access logs on the MCP server showing tool-call requests from client identities that never authenticated against the tenant.
Terraform state changes, plan runs, or provider API calls attributed to a user during periods when that user was not active.

Detection Strategies

Inventory all running terraform-mcp-server instances and confirm the transport mode configured for each.
Correlate MCP server request logs with Terraform audit trails to identify token reuse patterns across distinct source identities.
Alert on any tool invocation where the caller identity in the MCP request differs from the token owner recorded downstream in Terraform.

Monitoring Recommendations

Forward MCP server access logs and Terraform audit logs to a central analytics platform for correlation.
Monitor for unexpected terraform apply, workspace variable reads, or provider credential retrievals following MCP tool calls.
Track outbound API calls from MCP hosts to Terraform endpoints and flag divergence from baseline caller patterns.

How to Mitigate CVE-2026-16498

Immediate Actions Required

Upgrade terraform-mcp-server to version 1.1.0 or later on every host.
Rotate all Terraform tokens that were used with vulnerable server instances in streamable-HTTP stateless mode.
Review Terraform audit logs for the retention window and revert any unauthorized infrastructure changes.

Patch Information

HashiCorp fixed CVE-2026-16498 in terraform-mcp-server1.1.0. Consult HashiCorp Security Advisory HCSEC-2026-23 for the full advisory and release notes.

Workarounds

Disable the streamable-HTTP stateless transport mode until the upgrade is completed.
Restrict terraform-mcp-server to single-tenant deployments where all callers already share full trust.
Place the MCP server behind an authenticating reverse proxy that enforces per-caller identity and prevents shared session reuse.

bash

# Upgrade example using the official container image
docker pull hashicorp/terraform-mcp-server:1.1.0
docker stop terraform-mcp-server
docker rm terraform-mcp-server
docker run -d --name terraform-mcp-server \
  --restart unless-stopped \
  hashicorp/terraform-mcp-server:1.1.0