CVE-2026-14869
Named by 2 kept items in this workspace.
Search every workspace for CVE-2026-14869. It matches the name as written, so it can find other things that share it.
The items that name it 2
Server-side request forgery via client-supplied Terraform address (query parameter bypasses header check), allowing unauthenticated remote client to redirect server's bearer token to attacker-controlled endpoint; affects streamable-HTTP transport, not stdio mode.
Server-side request forgery in Terraform MCP Server; request middleware rejected client-supplied Terraform address via HTTP header but not via query parameter, allowing exfiltration of configured bearer token
All cves in this workspace.