CVE-2026-16498: Hashicorp Tooling

Critical severity, CVSS 10.0. EPSS: 0.5% chance of exploitation in the next 30 days.

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

Affected products

• Hashicorp Tooling: from 0.3.0, before 1.1.0 (fixed in 1.1.0)

Published 2026-07-28. Last modified 2026-07-30.