CVE-2026-16496
Named by 2 kept items in this workspace.
Search every workspace for CVE-2026-16496. It matches the name as written, so it can find other things that share it.
The items that name it 2
Authorization bypass via session credential cache in stateful mode; per-session Terraform client cache keyed solely by MCP session ID, not bound to the token that created it, allowing a user who obtains another user's session ID to access that victim's cached Terraform client/bearer token and their
Stateful-mode isolation failure in Terraform MCP Server; cache used MCP session ID as sole lookup key without binding to token, allowing session ID theft to run tool calls with victim's Terraform client
All cves in this workspace.