CVE-2026-14869: Hashicorp Tooling

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.

Affected products

• Hashicorp Tooling: from 0.3.0, before 1.1.0 (fixed in 1.1.0)

Published 2026-07-28. Last modified 2026-07-30.