HCSEC-2026-23 - Multiple vulnerabilities impacting HashiCorp Terraform MCP Server

What it is

Advisory HCSEC-2026-23 (published July 28, 2026) covering three vulnerabilities in HashiCorp's terraform-mcp-server, versions 0.2.1 through 1.0.0, fixed in 1.1.0. All three live in the streamable-HTTP transport used for centralized, multi-user deployments where each user supplies their own Terraform Cloud/Enterprise token per request. The value the summary omits is which mode triggers which CVE — and that stdio mode is unaffected by all three, so operators running stdio exclusively need take no action.

Preconditions / Affected

The three issues do not overlap in exposure — your deployment mode decides which apply:

flowchart TD
    A[terraform-mcp-server 0.2.1–1.0.0] --> B{Transport mode?}
    B -->|stdio only| C[Not affected]
    B -->|streamable-HTTP| D[CVE-2026-14869 SSRF<br/>unauthenticated]
    D --> E{HTTP state mode?}
    E -->|stateful = default| F[CVE-2026-16496<br/>session-cache hijack]
    E -->|stateless explicit| G[CVE-2026-16498<br/>cross-tenant reuse]

• CVE-2026-14869 (SSRF): any streamable-HTTP deployment; requires only the ability to reach the listener, no authentication.
• CVE-2026-16496: only stateful streamable-HTTP mode — which is the default when running the server centrally, so most central deployments are exposed. Requires the attacker to obtain a victim's session ID.
• CVE-2026-16498: only deployments explicitly configured for stateless HTTP mode.

How it works

• CVE-2026-14869: the request middleware rejected a client-supplied Terraform address when sent as an HTTP header, but applied no such check when the same value arrived as a query parameter. The server then pairs the attacker's address with its own configured bearer token and sends that token to the attacker's endpoint.
• CVE-2026-16496: the per-session Terraform client cache keys solely on the MCP session ID and never binds a cached client to the token that created it. Supplying a stolen session ID runs your tool calls under the victim's cached client and token.
• CVE-2026-16498: in stateless mode the underlying MCP library assigns no unique session IDs, so the session-keyed cache cannot isolate tenants — one tenant's token gets reused for subsequent tenants' requests regardless of what they supply.

What to do

• Upgrade to terraform-mcp-server 1.1.0.
• If you cannot upgrade immediately, the advisory states two interim controls: restrict network access to the streamable-HTTP listener to trusted users only, and treat MCP session IDs as sensitive values.

Caveats

The advisory frames upgrading as "consider" and asks customers to "evaluate the risk," not as a forced mandate. The interim controls are mitigations, not fixes — restricting the listener does not close the cross-tenant reuse (CVE-2026-16498) among the trusted users who remain.