EUVD-2026-49934
GHSA-rhh5-3xrh-6535
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend malicious request to streamable-HTTP endpoint
-
ExploitSSRF redirects Terraform API calls
-
ImpactAuthorization token exfiltrated to attacker-controlled server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The server must expose the streamable-HTTP transport over the network. No authentication or user interaction is required to trigger the SSRF. No non-default configuration is necessary beyond the server being operational with the affected transport. |
| Impact | The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating a critical-risk vulnerability: unauthenticated, low-complexity network attack with a scope change that can exfiltrate high-value authorization tokens. No EPSS data or CISA KEV listing is available, suggesting no known active exploitation at this time. The lack of a public proof-of-concept reduces immediate threat, but the technical characteristics make automated exploitation plausible. Under SSVC, the exploitation status is 'none', automatable is 'yes', and technical impact is 'partial' (high confidentiality impact). Missing POC and EPSS data limit full risk quantification, but the ability to steal cloud provider tokens justifies prompt remediation. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted request to the streamable-HTTP endpoint, causing the server to forward subsequent Terraform API requests and the accompanying authorization token to an attacker-controlled destination. The token can then be captured and reused to access cloud resources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to redirect Terraform API requests and steal server-side authorization tokens via the streamable-HTTP transport. The vulnerability, tracked as CVE-2026-14869, permits an attacker to control the destination of outbound requests, leading to token exposure. No public exploit or active exploitation has been reported at this time.
RemediationAI
Upgrade to terraform-mcp-server 1.1.0, which resolves CVE-2026-14869. The vendor advisory (https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606) provides release details. No workarounds are documented; if immediate patching is not feasible, restrict network access to the server’s HTTPS interface and consider temporarily disabling the streamable-HTTP transport, acknowledging that this may break functionality dependent on that transport.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The terraform-mcp-server is a Model Context Protocol server that enables AI assistants to interact with Terraform. The vulnerability resides in the streamable-HTTP transport layer and is classified as CWE-918 (Server-Side Request Forgery). Improper validation of user-supplied URLs allows an attacker to manipulate the target of server-initiated API calls. Affected products are identified by CPE cpe:2.3:a:hashicorp:tooling:*:*:*:*:*:*:*:*, corresponding to terraform-mcp-server versions prior to the fix.
Know when Tooling gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-accessible, low complexity, no privileges required, token exfiltration across security boundaries.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
2DescriptionCVE.org
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.
Articles & Coverage 1
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on beha
Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication
Cross-namespace authorization bypass in HashiCorp consul-k8s 0.42.0 and later can let an attacker with an existing low-p
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes te
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains ano
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the se
Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to impr
Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote att
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended
Exploit-DB