EUVD-2026-49934
GHSA-rhh5-3xrh-6535
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-accessible, low complexity, no privileges required, token exfiltration across security boundaries.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
3DescriptionCVE.org
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.
Articles & Coverage 1
AnalysisAI
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to redirect Terraform API requests and steal server-side authorization tokens via the streamable-HTTP transport. The vulnerability, tracked as CVE-2026-14869, permits an attacker to control the destination of outbound requests, leading to token exposure. No public exploit or active exploitation has been reported at this time.
Technical ContextAI
The terraform-mcp-server is a Model Context Protocol server that enables AI assistants to interact with Terraform. The vulnerability resides in the streamable-HTTP transport layer and is classified as CWE-918 (Server-Side Request Forgery). Improper validation of user-supplied URLs allows an attacker to manipulate the target of server-initiated API calls. Affected products are identified by CPE cpe:2.3:a:hashicorp:tooling:*:*:*:*:*:*:*:*, corresponding to terraform-mcp-server versions prior to the fix.
RemediationAI
Upgrade to terraform-mcp-server 1.1.0, which resolves CVE-2026-14869. The vendor advisory (https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606) provides release details. No workarounds are documented; if immediate patching is not feasible, restrict network access to the server’s HTTPS interface and consider temporarily disabling the streamable-HTTP transport, acknowledging that this may break functionality dependent on that transport.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on beha
Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes te
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains ano
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the se
Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to impr
Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote att
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today